CVE-2020-27950

What is Apple's kernel memory model?

The XNU kernel underlying iOS, iPadOS, macOS, and watchOS is the trusted core that every app, sandbox, and security boundary on Apple devices ultimately depends on. Kernel memory disclosure bugs are especially prized by attackers because modern exploit chains typically need an information leak to defeat address space layout randomization (ASLR) before a separate memory-corruption bug can be reliably turned into full code execution — making a kernel memory leak a key enabling link in a chain rather than a standalone bug.

Overview

CVE-2020-27950 is a memory initialization vulnerability that allows a malicious application to read uninitialized kernel memory, disclosing sensitive kernel-space data to an attacker-controlled process. Apple patched it in November 2020 alongside two other vulnerabilities — a font-parsing remote code execution bug and a separate kernel privilege escalation flaw — that were reported as being actively exploited together as a chain against iOS devices.

Technical Details

The flaw (CWE-665, Improper Initialization) occurs when kernel memory is allocated and returned to userspace without first being properly zeroed or initialized, allowing residual data from previous kernel operations — potentially including sensitive pointers useful for defeating ASLR — to be read by a lower-privileged local process. This class of bug typically requires local code execution as a prerequisite (i.e., the attacker already runs some code on the device, often via a separate exploit for an initial-access bug), which is reflected in the vulnerability's Local attack vector and requirement for some user interaction.

Discovery

Reported to Apple as part of a set of in-the-wild exploited iOS vulnerabilities investigated by Google's Threat Analysis Group (TAG) and Project Zero, whose researchers routinely track active zero-day exploitation of mobile platforms.

Exploitation Context

This vulnerability was patched by Apple specifically because it and its companion CVEs were being actively exploited against iOS users at the time of disclosure — Apple's own advisory language for this release acknowledged reports of in-the-wild exploitation. CISA's KEV listing corroborates this confirmed exploitation. Kernel information-leak bugs like this are a standard component of commercial and nation-state mobile exploit chains, valuable specifically because they enable reliable exploitation of separate memory-corruption bugs.

Remediation

1. Update to iOS 14.2, iPadOS 14.2, macOS, or watchOS versions containing the fix (or any later release) immediately.
2. Treat any device that cannot be updated as a standing exposure, given confirmed in-the-wild exploitation as part of a chain.
3. Enable automatic updates on managed Apple device fleets to minimize the window of exposure to future similar chains.
4. For high-risk users (journalists, activists, executives), consider Apple's Lockdown Mode and mobile threat defense tooling as defense-in-depth.
5. Review mobile device management (MDM) telemetry for signs of anomalous app behavior predating the patch.