CVE-2020-9859

What Makes Kernel-Level Bugs on Apple Devices Different?

Apple's device sandboxing model relies on strict isolation between apps and the kernel — a malicious or exploited app should only be able to affect its own data. A kernel-level vulnerability breaks that isolation, letting an app escalate from its sandboxed context to full system privileges, which is why kernel bugs are consistently the second half of complete jailbreak and targeted-attack exploitation chains.

Overview

CVE-2020-9859 is a double-free vulnerability (CWE-415) affecting iOS, iPadOS, macOS, watchOS, and tvOS that may allow a malicious application to execute code with kernel privileges (CVSS 3.1: AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, 7.8 High).

Technical Details

A double-free occurs when a program frees the same block of allocated memory twice; if an attacker can control what gets allocated into that memory between the two frees, they can often corrupt the heap in ways that lead to arbitrary code execution. Because this bug lives in shared kernel code across all five affected Apple OS families, the fix required coordinated patches across every platform simultaneously.

Discovery

Fixed as part of Apple's routine security update process across its OS families; not associated with a named external researcher credit in Apple's public advisory.

Exploitation Context

CISA added this CVE to KEV in November 2021 based on confirmed exploitation. As with most Apple kernel bugs, this vulnerability is most valuable to an attacker as the privilege-escalation component of a broader exploitation chain, rather than as a standalone initial-access vector.

Remediation

1. Update every affected Apple OS — iOS, iPadOS, macOS, watchOS, and tvOS — to the version including this fix or later.
2. Enable automatic software updates across all managed Apple device fleets, given how routinely kernel-level bugs of this kind are chained with application-level exploits.
3. Deploy mobile threat detection tooling for high-risk users who may be targeted with sophisticated multi-stage exploitation chains.
4. Patch every affected platform, not just the ones you consider primary — since this bug spans iOS, iPadOS, macOS, watchOS, and tvOS simultaneously, an organization managing multiple Apple device types needs to confirm all of them are updated.