Gabe Kirkpatrick

**Name of the Vulnerable Software and Affected Versions** Linux kernel (affected versions not specified) **Description** The issue is related to a use-after-free problem in the `svm register enc region()` function. This occurs when the cache flush of converted pages is not done before dropping `kvm->lock`, allowing a different task to free the region and/or its array of pages. The problem is exacerbated by the dynamic allocation of `region->pages`. Flushing multiple pages under `kvm->lock` is necessary but unfortunate, as it is only needed on CPUs lacking coherency for encrypted memory. The entire flow is a rare slow path. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** macOS versions prior to Big Sur 11.4 Security Update versions prior to 2021-003 Catalina Security Update versions prior to 2021-004 Mojave **Description** A use after free issue was addressed with improved memory management, allowing a malicious application to execute arbitrary code and potentially compromise user information. **Recommendations** For macOS versions prior to Big Sur 11.4, update to macOS Big Sur 11.4 or later. For Security Update versions prior to 2021-003 Catalina, apply Security Update 2021-003 Catalina or later. For Security Update versions prior to 2021-004 Mojave, apply Security Update 2021-004 Mojave or later.

**Name of the Vulnerable Software and Affected Versions** macOS versions prior to Big Sur 11.4 Security Update versions prior to 2021-003 Catalina Security Update versions prior to 2021-004 Mojave **Description** An application may be able to gain elevated privileges due to a vulnerability that was addressed by removing the vulnerable code. **Recommendations** For macOS versions prior to Big Sur 11.4, update to macOS Big Sur 11.4 or later. For Security Update versions prior to 2021-003 Catalina, apply Security Update 2021-003 Catalina or later. For Security Update versions prior to 2021-004 Mojave, apply Security Update 2021-004 Mojave or later.

**Name of the Vulnerable Software and Affected Versions** tvOS versions prior to 14.6 iOS versions prior to 14.6 iPadOS versions prior to 14.6 watchOS versions prior to 7.5 macOS Big Sur versions prior to 11.4 macOS Mojave versions prior to Security Update 2021-004 macOS Catalina versions prior to Security Update 2021-003 **Description** A memory corruption issue was addressed with improved state management. This issue may cause a denial of service or potentially disclose memory contents when exploited by a malicious application. The issue is related to a buffer overflow in memory, which can allow an attacker to access confidential information or cause a denial of service. **Recommendations** For tvOS versions prior to 14.6, update to tvOS 14.6 or later. For iOS versions prior to 14.6, update to iOS 14.6 or later. For iPadOS versions prior to 14.6, update to iPadOS 14.6 or later. For watchOS versions prior to 7.5, update to watchOS 7.5 or later. For macOS Big Sur versions prior to 11.4, update to macOS Big Sur 11.4 or later. For macOS Mojave versions prior to Security Update 2021-004, apply Security Update 2021-004 or later. For macOS Catalina versions prior to Security Update 2021-003, apply Security Update 2021-003 or later.

**Name of the Vulnerable Software and Affected Versions** Apple iOS versions prior to 14.6 Apple iPadOS versions prior to 14.6 Apple tvOS versions prior to 14.6 Apple watchOS versions prior to 7.5 Apple macOS versions prior to 11.4 **Description** A logic issue was addressed with improved state management, which could allow a local user to leak sensitive user information. The issue is related to the disclosure of information and may allow an attacker to access confidential information. **Recommendations** For Apple iOS versions prior to 14.6, update to iOS 14.6 or later. For Apple iPadOS versions prior to 14.6, update to iPadOS 14.6 or later. For Apple tvOS versions prior to 14.6, update to tvOS 14.6 or later. For Apple watchOS versions prior to 7.5, update to watchOS 7.5 or later. For Apple macOS versions prior to 11.4, update to macOS Big Sur 11.4 or apply Security Update 2021-004 for Mojave or Security Update 2021-003 for Catalina.

Name of the Vulnerable Software and Affected Versions: Apple iOS versions prior to 14.5 Apple iPadOS versions prior to 14.5 Apple watchOS versions prior to 7.4 Apple tvOS versions prior to 14.5 Apple macOS Big Sur versions prior to 11.3 Apple macOS Mojave versions prior to Security Update 2021-004 Apple macOS Catalina versions prior to Security Update 2021-003 Description: A race condition was addressed with improved locking, which may allow a remote attacker to cause a denial of service. Recommendations: For Apple iOS versions prior to 14.5, update to iOS 14.5 or later. For Apple iPadOS versions prior to 14.5, update to iPadOS 14.5 or later. For Apple watchOS versions prior to 7.4, update to watchOS 7.4 or later. For Apple tvOS versions prior to 14.5, update to tvOS 14.5 or later. For Apple macOS Big Sur versions prior to 11.3, update to macOS Big Sur 11.3 or later. For Apple macOS Mojave versions prior to Security Update 2021-004, apply Security Update 2021-004. For Apple macOS Catalina versions prior to Security Update 2021-003, apply Security Update 2021-003.

Name of the Vulnerable Software and Affected Versions: macOS Mojave versions prior to Security Update 2021-004 macOS Catalina versions prior to Security Update 2021-003 macOS Big Sur versions prior to 11.3 iOS versions prior to 14.5 iPadOS versions prior to 14.5 watchOS versions prior to 7.4 tvOS versions prior to 14.5 Description: The issue is related to the processing of maliciously crafted server messages, which may lead to heap corruption. Improved checks have been implemented to address this issue. Recommendations: For macOS Mojave, apply Security Update 2021-004. For macOS Catalina, apply Security Update 2021-003. For macOS Big Sur, update to version 11.3. For iOS, update to version 14.5. For iPadOS, update to version 14.5. For watchOS, update to version 7.4. For tvOS, update to version 14.5.

Name of the Vulnerable Software and Affected Versions: Apple macOS versions prior to 11.3 Apple iOS versions prior to 14.5 Apple iPadOS versions prior to 14.5 Apple watchOS versions prior to 7.4 Apple tvOS versions prior to 14.5 Description: A memory corruption issue was addressed with improved validation, which may allow an application to gain elevated privileges. Recommendations: For macOS versions prior to 11.3, apply Security Update 2021-002 Catalina or update to macOS Big Sur 11.3. For iOS versions prior to 14.5, update to iOS 14.5. For iPadOS versions prior to 14.5, update to iPadOS 14.5. For watchOS versions prior to 7.4, update to watchOS 7.4. For tvOS versions prior to 14.5, update to tvOS 14.5.