CVE-2020-9907

What Makes Kernel-Level Bugs on Apple Devices Different?

iOS, iPadOS, and tvOS rely on strict app sandboxing to contain any single app's potential damage — a malicious or exploited app should only affect its own data, not the rest of the device. A kernel-level memory corruption bug breaks that model: it lets code running inside a sandboxed app escalate to full kernel privileges, which is why kernel vulnerabilities are the essential second half of nearly every complete mobile jailbreak or targeted-attack exploitation chain.

Overview

CVE-2020-9907 is a memory corruption vulnerability (CWE-787) in the iOS/iPadOS/tvOS kernel that could allow a malicious application, once running on the device, to execute code with kernel privileges (CVSS 3.1: AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, 7.8 High). Apple fixed it in the iOS 14.0 / iPadOS 14.0 release cycle in September 2020, alongside the broader set of security fixes shipped with that major OS version.

Technical Details

The flaw allows an application, once it has achieved initial code execution (typically via some other vulnerability or a user installing malicious software), to trigger memory corruption in the kernel that an attacker can shape to escalate their privileges beyond what the app sandbox should permit. As with most kernel privilege-escalation bugs, this vulnerability is rarely the initial entry point in an attack — it's the component that turns a contained app-level compromise into full device control.

Discovery

Fixed as part of Apple's routine iOS 14.0 / iPadOS 14.0 release; not associated with a named external researcher credit specific to this CVE in Apple's public advisory.

Exploitation Context

CISA added this CVE to KEV in June 2022, nearly two years after the original fix, based on confirmed exploitation of devices that had never been updated past iOS/iPadOS 13.x or earlier — a reminder that mobile OS version fragmentation (users delaying or skipping major version upgrades) leaves a long tail of exploitable devices well past a vulnerability's original patch date.

Remediation

1. Update to the latest available iOS, iPadOS, or tvOS version for your device — this fix has been available since September 2020, and remaining on an older major version leaves this and many subsequent vulnerabilities unpatched.
2. Enable automatic software updates on all managed Apple devices to prevent long-tail exposure to years-old, publicly known vulnerabilities.
3. Retire devices that can no longer run a supported iOS/iPadOS/tvOS version, particularly in business or government environments where compromise risk carries organizational consequences.
4. Treat any device still running iOS/iPadOS 13.x or earlier as carrying accumulated, unpatched risk from this and other vulnerabilities fixed in subsequent major releases.