System-privilege code execution via Core Motion validation

Code execution in Core Motion in Apple iOS and iPadOS before 14.5 allows malicious applications to execute arbitrary code with system privileges. The Core Motion component performs insufficient validation in a logic path handling data supplied by a malicious application. Exploitation requires a malicious application running locally on the device; successful exploitation can execute attacker-controlled code with system privileges, while the public record does not describe remote reachability.