Apple iOS/iPadOS up to 14.5.1 WebRTC null pointer dereference

Summaryinfo

A vulnerability classified as problematic has been found in Apple iOS and iPadOS up to 14.5.1. The affected element is an unknown function of the component WebRTC. The manipulation leads to null pointer dereference. This vulnerability is listed as CVE-2021-23841. The attack may be initiated remotely. There is no available exploit. It is recommended to upgrade the affected component.

Detailsinfo

A vulnerability was found in Apple iOS and iPadOS up to 14.5.1 (Smartphone Operating System). It has been rated as problematic. This issue affects some unknown processing of the component WebRTC. The manipulation with an unknown input leads to a null pointer dereference vulnerability. Using CWE to declare the problem leads to CWE-476. A NULL pointer dereference occurs when the application dereferences a pointer that it expects to be valid, but is NULL, typically causing a crash or exit. Impacted is availability.

The weakness was presented 05/24/2021 by Tavis Ormandy as HT212528 as confirmed advisory (Website). It is possible to read the advisory at support.apple.com. The identification of this vulnerability is CVE-2021-23841. It demands that the victim is doing some kind of user interaction. The technical details are unknown and an exploit is not publicly available. The pricing for an exploit might be around USD $0-$5k at the moment (estimation calculated on 02/06/2026). It is expected to see the exploit prices for this product increasing in the near future. The advisory points out:

A remote attacker may be able to cause a denial of service

The vulnerability scanner Nessus provides a plugin with the ID 211827 (Oracle Linux 9 : edk2 (ELSA-2024-12842)), which helps to determine the existence of the flaw in a target environment.

Upgrading to version 14.6 eliminates this vulnerability. A possible mitigation has been published immediately after the disclosure of the vulnerability. The advisory contains the following remark:

A null pointer dereference was addressed with improved input validation.

The vulnerability is also documented in the databases at Tenable (211827) and CERT Bund (WID-SEC-2022-0669). Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Affected

• Open Source CentOS
• Open Source OpenSSL
• Debian Linux
• Amazon Linux 2
• FreeBSD Project FreeBSD OS
• Juniper JUNOS
• Red Hat Enterprise Linux
• Ubuntu Linux
• SUSE Linux
• Oracle Linux
• Hitachi Command Suite
• Gentoo Linux
• Open Source Arch Linux
• Avaya Aura Communication Manager
• Avaya Aura Session Manager
• Avaya Aura Application Enablement Services
• Avaya Aura System Manager
• Avaya Web License Manager
• Pulse Secure Pulse Connect Secure
• HCL BigFix
• Hitachi Ops Center
• Open Source Node.js
• Meinberg LANTIME
• Tenable Security Nessus
• Netscout Arbor AED
• Netscout Arbor APS
• Netscout Arbor Sightline
• Netscout Arbor TMS
• Tenable Security Nessus Network Monitor
• HPE Fabric OS
• Hitachi Configuration Manager
• F5 BIG-IP
• Trellix ePolicy Orchestrator
• IBM Rational Build Forge
• Dell NetWorker
• SolarWinds Platform
• F5 F5OS

Productinfo

Type

• Smartphone Operating System

Vendor

• Apple

Name

• iOS
• iPadOS

Version

• 14.5.0
• 14.5.1

License

• commercial

Website

• Vendor: https://www.apple.com/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion