CVE-2021-30777

Vulnerability

An injection issue exists in macOS that allows a malicious application to escalate privileges to root. The vulnerability is present in macOS Big Sur before version 11.5, macOS Catalina before Security Update 2021-004, and macOS Mojave before Security Update 2021-005 [1][2][3]. The exact component and injection vector are not publicly detailed by Apple.

Exploitation

An attacker must have the ability to run a malicious application on the target system. No additional authentication or network access is required beyond the initial execution of the application. The injection flaw is triggered when the application processes crafted input, leading to privilege escalation.

Impact

Successful exploitation allows the malicious application to gain root privileges, giving the attacker full control over the affected system. This includes the ability to install software, modify system files, and access sensitive data.

Mitigation

Apple released fixes on July 21, 2021, in macOS Big Sur 11.5, Security Update 2021-004 for Catalina, and Security Update 2021-005 for Mojave [1][2][3]. Users should update to these versions or later. No workarounds are available.