^{CVE-2021-30860:}Integer Overflow in Apple CoreGraphics PDF Processing (FORCEDENTRY Exploit)

Overview

This vulnerability (CWE-190: Integer Overflow or Wraparound) exists in Apple's implementation of the JBIG2 decoder within CoreGraphics. When processing specially crafted PDF files, an integer overflow condition occurs that can lead to memory corruption and arbitrary code execution with the privileges of the application processing the PDF. What makes this vulnerability particularly dangerous is:

1. It can be exploited through zero-click attacks - no user interaction required
2. It was used in the wild as part of sophisticated spyware campaigns
3. It affected multiple Apple platforms including mobile and desktop systems
4. The exploit was delivered through various channels including iMessage

The vulnerability was discovered by Citizen Lab researchers who found it being used against activists' devices and reported it to Apple, which led to emergency security updates.

Remediation

To mitigate this vulnerability, users should update their Apple devices to the following versions or later:

• iOS and iPadOS: Update to version 14.8 or later
• macOS Big Sur: Update to version 11.6 or later
• macOS Catalina: Install Security Update 2021-005
• watchOS: Update to version 7.6.2 or later
• iOS 12 (older devices): Update to version 12.5.5

Organizations should:

1. Prioritize patching all Apple devices immediately
2. Implement security controls to prevent untrusted PDF documents from being processed
3. Monitor for suspicious activities that might indicate compromise
4. Consider implementing mobile device management (MDM) solutions to ensure timely updates
5. Educate users about the risks of opening documents from untrusted sources

References

1. Apple Security Updates:

   • iOS and iPadOS 14.8: https://support.apple.com/en-us/HT212807
   • macOS Big Sur 11.6: https://support.apple.com/en-us/HT212804
   • Security Update 2021-005 Catalina: https://support.apple.com/en-us/HT212805
   • watchOS 7.6.2: https://support.apple.com/en-us/HT212806
   • iOS 12.5.5: https://support.apple.com/kb/HT212824

2. Technical Analysis:

   • Citizen Lab's analysis of the FORCEDENTRY exploit
   • JBIG2 integer overflow details: http://www.openwall.com/lists/oss-security/2022/09/02/11

3. Security Advisories:

   • Gentoo Security Advisory: https://security.gentoo.org/glsa/202209-21
   • Apple Security Announcements: http://seclists.org/fulldisclosure/2021/Sep/38