CVE-2021-1782
Apple Mac Os X 10.14 – 10.14.6
Raw vector
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:HSummary
CVE-2021-1782 is a high-severity Improper Locking (CWE-667) vulnerability in Apple Mac Os X. Its CVSS base score is 7.0 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Endpoint Denial of Service (T1499); ranked in the top 19% of CVEs by exploit likelihood; CISA has added it to the Known Exploited Vulnerabilities catalog.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
A race condition vulnerability stemming from improper locking, tracked as CVE-2021-1782 and assigned CWE-667, affects multiple Apple operating systems including macOS Big Sur, Catalina, and Mojave along with iOS 14, iPadOS 14, tvOS 14, and watchOS 7. The flaw permits a malicious application to elevate privileges on the affected platform, as confirmed by its CVSS 3.1 vector indicating local attack with high complexity but full impact on confidentiality, integrity, and availability.
An attacker with the ability to run code as a low-privileged local user can exploit the race condition to gain elevated rights. Because the issue requires only local access and no user interaction, it can be triggered from within a sandboxed or third-party application that an end user has already installed.
Apple has released fixes in macOS Big Sur 11.2, Security Update 2021-001 for Catalina and Mojave, iOS 14.4 and iPadOS 14.4, tvOS 14.4, and watchOS 7.3; the corresponding security advisories direct administrators to apply these updates to address the locking deficiency.
Apple has stated that it is aware of reports indicating the vulnerability may have been actively exploited in the wild prior to patching.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2021-7246
Vulnerability Data
A race condition was addressed with improved locking. This issue is fixed in macOS Big Sur 11.2, Security Update 2021-001 Catalina, Security Update 2021-001 Mojave, watchOS 7.3, tvOS 14.4, iOS 14.4 and iPadOS 14.4. A malicious application may be able…
more
to elevate privileges. Apple is aware of a report that this issue may have been actively exploited..
- CWE(s)
- KEV Date Added
- 03 November 2021
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Secure SDLC practices directly include code reviews, static analysis, and concurrency standards that prevent improper locking.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Security testing can detect race conditions and locking errors before release.
Secure development lifecycle includes concurrency and locking requirements that reduce improper locking defects.
Application security requirements can mandate proper lock acquisition/release patterns.
Secure architecture principles address thread-safety and resource synchronization.
Secure coding standards directly prohibit missing or incorrect lock usage.
Change management may catch locking issues introduced by modifications but does not prevent the weakness itself.