CVE-2020-27932

What Makes Kernel-Level Bugs on iOS Different?

Every mobile OS relies on strict process sandboxing to contain the damage a compromised app can do — a malicious or exploited app should only be able to affect its own data, not the rest of the device. A kernel-level vulnerability breaks that model entirely: it lets code running inside a sandboxed process escape the sandbox and execute with full system privileges, which is exactly why kernel bugs are the second half of nearly every complete mobile exploitation chain.

Overview

CVE-2020-27932 is a type confusion vulnerability (CWE-843) in the iOS/iPadOS/macOS/watchOS kernel that may allow a malicious application to execute code with kernel privileges (CVSS 3.1: AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, 7.8 High). Apple patched it in November 2020 alongside CVE-2020-27930 (a FontParser memory corruption bug providing initial code execution, also enriched on this site) and CVE-2020-27950 (a kernel memory disclosure issue), acknowledging all three "may have been actively exploited."

Technical Details

A type confusion vulnerability occurs when code treats a piece of memory as one data type when it actually holds a different, incompatible type — the kernel's internal logic then operates on that memory using assumptions that don't match its real structure, corrupting kernel state in ways an attacker can manipulate. Because this bug lives in the kernel rather than in an application sandbox, successful exploitation grants the attacker the highest privilege level on the device, well beyond whatever the initially-exploited application was permitted to do.

Discovery

Reported to Apple by Clément Lecigne and Sergei Glazunov of Google's Threat Analysis Group / Project Zero, as part of the same disclosure covering the companion FontParser and kernel memory-disclosure bugs.

Exploitation Context

Apple's advisory acknowledged active in-the-wild exploitation for this vulnerability cluster — a strong signal this wasn't merely theoretical research but was being used against real targets. As the privilege-escalation half of a documented three-bug chain, this CVE is the piece that turns FontParser-level code execution (CVE-2020-27930) into full device compromise.

Remediation

1. Update iOS, iPadOS, macOS, and watchOS to the version that includes this fix and its two companion CVEs immediately.
2. Enable automatic OS updates across managed Apple device fleets to minimize exposure windows for kernel-level 0-days of this kind.
3. Deploy mobile threat detection tooling capable of detecting anomalous kernel-level behavior, particularly for high-risk users (executives, journalists, activists) more likely to be targeted by sophisticated exploitation chains using bugs like this one.
4. Treat this CVE as evidence that patch cadence matters as much for kernel bugs as for user-facing ones — a fully-patched FontParser is only half the protection if the kernel-side escape remains unpatched.