Apple Core Telephony Sandbox Bypass Vulnerability

A deserialization vulnerability in the Core Telephony framework of Apple iOS, macOS, and watchOS allows a sandboxed process to bypass sandbox restrictions. This issue was addressed with improved validation and is fixed in multiple Apple software updates. At the time of the release, Apple was aware of reports suggesting that this vulnerability may have been actively exploited.

Impact

Exploitation of this vulnerability could lead to unauthorized access to resources or capabilities that are normally restricted by the sandbox, potentially allowing a malicious process to perform actions or access data that it should not be able to.

Remediation

Users can apply the Security Update 2021-005 Catalina, or update to iOS 12.5.5, iOS 14.8, iPadOS 14.8, macOS Big Sur 11.6, or watchOS 7.6.2.