CVE-2014-4388 — Improper Input Validation in Apple Iphone OS

CWE-20 — Improper Input Validation5 documents3 sources
Severity
7.8HIGHNVD
EPSS
0.5%
top 32.25%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
3
Apple Iphone OSApple MAC OS XApple Tvos
Timeline
PublishedSep 18
Latest updateMay 14

Description

IOKit in Apple iOS before 8 and Apple TV before 7 does not properly validate IODataQueue object metadata, which allows attackers to execute arbitrary code in a privileged context via an application that provides crafted values in unspecified metadata fields, a different vulnerability than CVE-2014-4418.

CVSS vector

CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HExploitability: 1.8 | Impact: 5.9

Affected Packages3 packages

▶NVDapple/tvos6.2+6
▶NVDapple/mac_os_x10.9.5
▶NVDapple/iphone_os7.1.2+9

🔴Vulnerability Details

3
GHSA
GHSA-rrx9-g93w-q6f3: IOKit in Apple iOS before 8 and Apple TV before 7 does not properly validate IODataQueue object metadata, which allows attackers to execute arbitrary↗2022-05-14
▶
GHSA
GHSA-7w3x-rv8c-m437: IOKit in Apple iOS before 8 and Apple TV before 7 does not properly validate IODataQueue object metadata, which allows attackers to execute arbitrary↗2022-05-14
▶
Project0
Deja-XNU - Project Zero↗2018-10-01
▶