Kernel memory disclosure in Apple iOS/macOS/watchOS
CVE-2020-27950 is an Apple kernel information disclosure vulnerability caused by a memory initialization issue. Apple states that a malicious application may be able to disclose kernel memory. The issue affected Apple platforms including iOS/iPadOS, macOS, and watchOS, and was fixed in iOS 14.2, iPadOS 14.2, iOS 12.4.9, macOS Big Sur 11.0.1, macOS Catalina 10.15.7 Supplemental Update / Update, Security Update 2020-006 for Mojave and High Sierra, and watchOS 5.3.9, 6.2.9, and 7.1. The available context further characterizes the bug as a kernel memory leak/infoleak and notes it was used as the 'Dynamo' privilege-escalation infoleak component in the Coruna exploit kit against iOS 13.x.
Are you exposed to this one?
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
Impact, mitigation & remediation
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
Impact
What an attacker gets, and what they’ve been doing with it.
Mitigation
If you can’t patch tonight, do this now.
Remediation
Patch, then assume compromise.
Exploits
2 valid exploits after Mallory filtered fakes, detection scripts, and README-only repos.
This repository contains two C source files implementing proof-of-concept exploits for CVE-2020-27950, a Mach port pointer leak vulnerability affecting Apple macOS and iOS. The file 'CVE-2020-27950_leak_port.c' is the main exploit, which manipulates Mach ports and messages to leak the kernel address of a Mach port, thereby bypassing KASLR and aiding further kernel exploitation. The file 'CVE-2020-27950_poc.c' is a simpler proof-of-concept that demonstrates the ability to leak a value from the Mach message trailer. Both files are standalone C programs intended to be compiled and run locally on a vulnerable system. The repository does not contain any network endpoints or remote attack vectors; exploitation requires local code execution. The README is minimal and simply identifies the CVE. The overall structure is straightforward, with each C file serving as an entry point for its respective exploit logic.
This repository provides a Bash script ('browser_crash.sh') and a README for exploiting CVE-2020-27950, a vulnerability in iOS WebKit, using Metasploit's 'webkit_backdrop_filter_blur' auxiliary module. The script automates the setup by checking for Metasploit and ngrok, installing ngrok if missing, and launching an ngrok tunnel to expose a local web server to the internet. It then starts Metasploit to serve a crafted web page that, when visited by a vulnerable browser (notably iOS WebKit, but reportedly also other browsers), causes the browser to crash (Denial of Service). The script outputs a public URL (via ngrok) to be sent to the target. The repository is structured simply, with the main exploit logic in the Bash script and usage instructions in the README. No fake or malicious destructive actions are present; the exploit is operational and automates a real DoS attack against browsers vulnerable to CVE-2020-27950.
Affected products & vendors
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
Recent activity
10 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
An iOS vulnerability listed as exploited by the Coruna exploit kit.
An information leak privilege escalation component used in the Coruna exploit kit.
An information disclosure (infoleak) vulnerability used in Coruna exploit chains to defeat memory protections and support subsequent exploitation steps.
An iOS information leak used as part of a privilege-escalation chain component in Coruna samples, affecting iOS 13.x and fixed in iOS 14.2.
The version that knows your environment.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.