Intel

CVE-2021-30666

Red Hat Security Advisory: webkitgtk4 security update

criticalKEV: actively exploitedPoCEPSS 3%

Description

A buffer overflow issue was addressed with improved memory handling. This issue is fixed in iOS 12.5.3. Processing maliciously crafted web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited..

Source: REDHAT_CSAFCISA_KEVNVDCVEORGCVELISTV5

Response & Mitigation

Why act now?

Prioritisation rationale

CVE-2021-30666 is scoped to iOS 12.x — a branch that runs only on older hardware incapable of upgrading to iOS 14 or later, making patching the sole definitive fix for affected devices. Apple confirmed active exploitation at the time of disclosure, and the EPSS score of 86.5th percentile reflects a high real-world exploitation probability despite the vulnerability requiring one user interaction (UI:R in the CVSS:3.1 vector AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H). The attack chain — a crafted web page triggering a WebKit buffer overflow leading to arbitrary code execution — is well-suited to drive-by delivery via malvertising or targeted phishing links, requiring no credentials or elevated access from the attacker. KRITIS and NIS2-scope organisations operating legacy iOS devices in operational roles (shift-supervisor handhelds, industrial tablets) should treat this as a high-priority finding: inventory those assets immediately, patch where possible, and remove from network access where patching is not feasible.

Runbook · Step 1

Immediate response (0-24 h)

  • Apply the vendor patch now: Update all affected devices to iOS 12.5.3 via Settings → General → Software Update. Devices limited to the iOS 12.x branch (e.g. iPhone 5s, iPhone 6) cannot be upgraded to iOS 14/15 and must be treated as the highest priority.
  • Enforce MDM compliance policy: Via Apple Business Manager, Jamf, or Microsoft Intune, set a minimum OS version of iOS 12.5.3. Non-compliant devices must be immediately blocked from corporate resources — VPN profiles, Exchange ActiveSync, and Wi-Fi configuration profiles should all be revoked automatically on non-compliance.
  • Disable Safari and WebKit-based in-app browsers: Until patch rollout is confirmed, push an MDM configuration profile that disables Safari (Restrictions → Allow Safari = false) and audit third-party apps using embedded WKWebView rendering for business necessity.
  • Isolate devices that cannot be patched: Hardware that has reached end-of-support and cannot run iOS 12.5.3 must be removed from the corporate network and formally documented as an accepted or transferred risk.
  • Initiate threat hunting: Query Mobile Threat Defense telemetry (Lookout, Microsoft Defender for Endpoint on iOS, or equivalent) for anomalous WebKit process crashes or unexpected outbound connections following web browsing activity — look back at least 30 days.

Runbook · Step 2

Mitigation layers

  • Network segmentation: Move mobile devices into a dedicated VLAN with egress filtering; restrict outbound connections to categorised destinations via a proxy with URL categorisation (e.g. Zscaler, Cisco Umbrella).
  • DNS sinkholing / Secure Web Gateway: Block malvertising and exploit-kit domains via DNS Response Policy Zones or a cloud SWG; subscribe to threat-intelligence feeds (e.g. MISP community lists) to block known exploit-kit infrastructure in near-real-time.
  • CSP and WAF for internally hosted web content: Apply strict Content Security Policy headers to all internally hosted web applications to reduce JavaScript injection as an attack surface; enable WAF rules alerting on abnormally large HTML/JS payloads.
  • Enforce Supervised Mode via MDM: Ensure managed devices cannot remove MDM profiles themselves (Supervised Mode), preserving patch-compliance enforcement even if a device is partially compromised.
  • User awareness notice: Issue an immediate advisory to all mobile device users: do not open unsolicited links received via SMS, iMessage, or email. Browser-based exploits of this class are typically delivered through social engineering or malvertising.

Runbook · Step 3

Detection rules

  • MTD telemetry: Alert on repeated WebKit/Safari process crashes (crash reporter logs read by the MTD agent) — threshold: more than 2 crashes within 10 minutes following a web page visit.
  • Proxy / SWG logs (KQL sketch): CommonSecurityLog | where DeviceVendor == "Zscaler" and RequestURL matches regex @"(\.php\?|%[0-9a-f]{2}){5,}" and DeviceAction == "Allowed" and SourceIP in (mobile_device_ip_list) — Flag high-entropy URLs or unusually long query strings consistent with heap-spray payload delivery.
  • DNS telemetry (Zeek / Suricata): Alert on queries from mobile endpoints to domains with TTL < 60 s combined with a high NXDOMAIN rate — a characteristic pattern of exploit-kit infrastructure.
  • MDM compliance events: Correlate MDM API events reporting "OS version below minimum" with active firewall or proxy sessions from the same device — raise a P2 incident ticket automatically.
  • Network anomaly: Detect unexpected outbound TLS connections on port 443 from an iOS device immediately following a multi-hop HTTP redirect chain (proxy logs showing a Referer chain of more than 3 distinct external domains within a single session).

Metrics

Severity
critical
Priority score
218.77
KEV status
Actively exploited
Exploit maturity
actively exploited (KEV)
XIEM Effective CVSS
8.8
Source: nvd-v3
CVSS v3
8.8
CVSS v4
—
EPSS percentile
86.6 %
Critical — this CVE ranks in the top fifth of all CVEs scored today (rank ≥ 80%).
EPSS score
3.0 %
Moderate — model estimates 1-10% exploitation likelihood.
Published
2025-07-07 02:28 UTC
CWE
—

Affected operating systems

  • linux

    debian / debian_linux10.0

  • linux

    debian / debian_linux11.0

  • linux

    debian / debian_linux12.0

  • linux

    redhat / enterprise_linux6.0

  • linux

    redhat / enterprise_linux7.0

  • linux

    redhat / enterprise_linux8.0

  • linux

    redhat / enterprise_linux9.0

  • macos

    apple / mac_os_x10.14.6

  • macos

    apple / mac_os_x10.15.7

  • macos

    apple / mac_os_x

  • macos

    apple / macos

  • macos

    apple / visionos

  • mobile

    apple / iphone_os

  • other

    fedoraproject / fedora32

  • other

    fedoraproject / fedora33

  • other

    fedoraproject / fedora35

  • other

    fedoraproject / fedora36

  • other

    fedoraproject / fedora37

  • other

    fedoraproject / fedora38

  • other

    fedoraproject / fedora39

  • other

    fedoraproject / fedora40

  • other

    apple / ipados

  • other

    apple / tvos

  • other

    apple / watchos

Affected products

Products and version ranges extracted from the vendor/CERT advisory. A range like „<4.14.6“ implies the update recommendation „upgrade to 4.14.6 or later“.

  • apple

    safari14.1

  • apple

    safari14.1.1

  • apple

    safari15.3

  • apple

    safari15.6

  • apple

    safari15.6.1

  • apple

    safari16.0

  • apple

    safari16.2

  • apple

    safari16.3

  • apple

    safari16.4

  • apple

    safari16.4.1

  • apple

    safari16.5

  • apple

    safari16.5.1

  • apple

    safari16.5.2

  • apple

    safari17.0

  • apple

    safari17.1.2

  • apple

    safari17.2

  • apple

    safari17.6

  • apple

    safari18.0

  • apple

    safari18.2

  • apple

    safari18.4

  • bitnami

    jre1.9.0

  • google

    chrome124.0.6367.155

  • google

    chrome35.0.1916.113

  • google

    chrome

Public exploit references

Public proof-of-concepts and detection templates for this vulnerability. Maturity ranges from reported PoCs through working detection scripts up to fully weaponized exploit modules. NEOSEC mirrors the code internally for forensic analysis; externally we only link to the original sources.

References & sources

Linked CVEs

Show 205 more CVEs
IDCVE-2021-30666