CVE-2021-31006: Input Validation

Q: What is the vulnerability ID of this issue?

The vulnerability ID of this issue is CVE-2021-31006.

Q: What is the description of this vulnerability?

This vulnerability is a permissions issue that has been addressed with improved validation.

Q: Which software products are affected by this vulnerability?

This vulnerability affects Apple watchOS up to version 7.6, Apple tvOS up to version 14.7, and Apple macOS Big Sur up to version 11.5.

Q: How can I fix this vulnerability?

To fix this vulnerability, install the latest version of the affected software as mentioned in the references provided.

Q: Are there any official references for this vulnerability?

Yes, you can find official references for this vulnerability at the following links: [Link 1](https://support.apple.com/en-us/HT212605), [Link 2](https://support.apple.com/en-us/HT212604), [Link 3](https://support.apple.com/en-us/HT212602).

Published Jul 19, 2021

Updated

ActionKit. An input validation issue was addressed with improved input validation.

Other sources

AMD Kernel. A memory corruption issue was addressed with improved input validation.

— Apple

Analytics. A logic issue was addressed with improved restrictions.

— Apple

App Store. A permissions issue was addressed with improved validation.

— Apple

App Store. Description: A permissions issue was addressed with improved validation.

AppKit. An information disclosure issue was addressed by removing the vulnerable code.

— Apple

Credit

Csaba Fitzl@@theevilbit(Offensive Security), Zachary Keffaber@@QuickUpdate5, Denis Tokarev@@illusionofcha0s, tr3e, JunDong Xie(Ant Security Light), Mickey Jin@@patch1t(Trend Micro), Sunglin(Knownsec 404 team), Yizhuo Wang(Group of Software Security In Progress), Tim Michaud@@TimGMichaud(Zoom Video Communications), Linus Henze (pinauten.de), tr3e(Trend Micro Zero Day Initiative), hjy79425575(Trend Micro Zero Day Initiative), Jzhu(Baidu Security), Ye Zhang@@co0py_Cat(Baidu Security), Mickey Jin@@patch1t(Trend Micro working with Trend Micro Zero Day Initiative), CVE-2021-3518, Georgi Valkov (httpstorm.com), Christoph Guttandin(Media Codings), Sergei Glazunov(Google Project Zero), Ivan Fratric(Google Project Zero), George Nosenko, ryuzaki, Zhongcheng Li (CK01), Ron Waisberg@@epsilan, Gary Nield(ECSC Group plc), Wojciech Reguła@@_r3ggi(SecuRing), Matt Shockley (twitter.com/mattshockl)(Offensive Security), CFF(Topsec Alpha Team), Anonymous(Trend Micro Zero Day Initiative), Liu Long(Ant Security Light), Yinyi Wu@@3ndy1(Qihoo 360 Vulcan Team), Zuozhi Fan@@pattern_F_(Ant Security TianQiong Lab), ABC Research s.r.o, Matthew Denton(Google Chrome Security)

Affected Software

6 affected componentsFixes available

Apple macOS Big Sur<11.5

11.5

Apple tvOS<14.7

14.7

Apple WatchOS<7.6

7.6

Apple macOS>=11.0<11.5

Apple tvOS<14.7

Apple WatchOS<7.6

Event History

Jul 19, 2021

Data Sourced

via Apple·12:00 AM

DescriptionWeaknessAffected Software

Updated

via Apple·12:00 AM

DescriptionWeakness

Updated

via Apple·12:00 AM

Affected Software

Updated

via Apple·12:00 AM

DescriptionWeaknessAffected Software

Jul 21, 2021

Updated

via Apple·12:00 AM

DescriptionWeaknessAffected Software

Updated

via Apple·12:00 AM

Affected Software

Aug 24, 2021

CVE Published

via MITRE·06:51 PM

Data Sourced

via MITRE·06:51 PM

DescriptionWeakness

Parent advisories

This vulnerability appears in the following advisories.

Frequently Asked Questions

What is the vulnerability ID of this issue?

The vulnerability ID of this issue is CVE-2021-31006.

What is the description of this vulnerability?

This vulnerability is a permissions issue that has been addressed with improved validation.

Which software products are affected by this vulnerability?

This vulnerability affects Apple watchOS up to version 7.6, Apple tvOS up to version 14.7, and Apple macOS Big Sur up to version 11.5.

How can I fix this vulnerability?

To fix this vulnerability, install the latest version of the affected software as mentioned in the references provided.

Are there any official references for this vulnerability?

Yes, you can find official references for this vulnerability at the following links: [Link 1](https://support.apple.com/en-us/HT212605), [Link 2](https://support.apple.com/en-us/HT212604), [Link 3](https://support.apple.com/en-us/HT212602).

CVE-2021-31006: Input Validation

Other sources

Credit

Affected Software

Event History

Parent advisories

Peer vulnerabilities

Don't miss critical vulnerabilities

Frequently Asked Questions

What is the vulnerability ID of this issue?

What is the description of this vulnerability?

Which software products are affected by this vulnerability?

How can I fix this vulnerability?

Are there any official references for this vulnerability?

Company

Resources

Contact