CVE-2014-4418
published 2014-09-18CVE-2014-4418: IOKit in Apple iOS before 8 and Apple TV before 7 does not properly validate IODataQueue object metadata, which allows attackers to execute arbitrary code in a…
PriorityP338high7.8CVSS 3.0
AVLACLPRNUIRSUCHIHAH
EPSS
1.66%
74.2th percentile
IOKit in Apple iOS before 8 and Apple TV before 7 does not properly validate IODataQueue object metadata, which allows attackers to execute arbitrary code in a privileged context via an application that provides crafted values in unspecified metadata fields, a different vulnerability than CVE-2014-4388.
Affected
18 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apple | iphone_os | <= 7.1.2 | — |
| apple | iphone_os | — | — |
| apple | iphone_os | — | — |
| apple | iphone_os | — | — |
| apple | iphone_os | — | — |
| apple | iphone_os | — | — |
| apple | iphone_os | — | — |
| apple | iphone_os | — | — |
| apple | iphone_os | — | — |
| apple | iphone_os | — | — |
| apple | mac_os_x | <= 10.9.5 | — |
| apple | tvos | <= 6.2 | — |
| apple | tvos | — | — |
| apple | tvos | — | — |
| apple | tvos | — | — |
| apple | tvos | — | — |
| apple | tvos | — | — |
| apple | tvos | — | — |
CVSS provenance
nvdv3.07.8HIGHCVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
nvdv2.09.3CRITICALAV:N/AC:M/Au:N/C:C/I:C/A:C
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-rrx9-g93w-q6f3: IOKit in Apple iOS before 8 and Apple TV before 7 does not properly validate IODataQueue object metadata, which allows attackers to execute arbitrary
ghsa_unreviewed·2022-05-14·CVSS 7.8
CVE-2014-4418 [HIGH] CWE-20 GHSA-rrx9-g93w-q6f3: IOKit in Apple iOS before 8 and Apple TV before 7 does not properly validate IODataQueue object metadata, which allows attackers to execute arbitrary
IOKit in Apple iOS before 8 and Apple TV before 7 does not properly validate IODataQueue object metadata, which allows attackers to execute arbitrary code in a privileged context via an application that provides crafted values in unspecified metadata fields, a different vulnerability than CVE-2014-4388.
GHSA
GHSA-7w3x-rv8c-m437: IOKit in Apple iOS before 8 and Apple TV before 7 does not properly validate IODataQueue object metadata, which allows attackers to execute arbitrary
ghsa_unreviewed·2022-05-14·CVSS 7.8
CVE-2014-4388 [HIGH] CWE-20 GHSA-7w3x-rv8c-m437: IOKit in Apple iOS before 8 and Apple TV before 7 does not properly validate IODataQueue object metadata, which allows attackers to execute arbitrary
IOKit in Apple iOS before 8 and Apple TV before 7 does not properly validate IODataQueue object metadata, which allows attackers to execute arbitrary code in a privileged context via an application that provides crafted values in unspecified metadata fields, a different vulnerability than CVE-2014-4418.
Project0
Deja-XNU - Project Zero
project_zero·2018-10-01·CVSS 7.8
CVE-2014-4388 [HIGH] Deja-XNU - Project Zero
Posted by Ian Beer, Google Project Zero
This blog post revisits an old bug found by Pangu Team and combines it with a new, albeit very similar issue I recently found to try to build a "perfect" exploit for iOS 7.1.2.
State of the art
An idea I've wanted to play with for a while is to revisit old bugs and try to exploit them again, but using what I've learnt in the meantime about iOS. My hope is that it would give an insight into what the state-of-the-art of iOS exploitation could have looked like a few years ago, and might prove helpful if extrapolated forwards to think about what state-of-the-art exploitation might look like now.
So let's turn back the clock to 2014...
Pangu 7
On June 23 2014 @PanguTeam released the Pangu 7 jailbreak for iOS 7.1-7.1.x. They exploited a lot of bu
Project0
More Mac OS X and iPhone sandbox escapes and kernel bugs - Project Zero
project_zero·2014-10-01·CVSS 6.9
CVE-2014-4376 [MEDIUM] More Mac OS X and iPhone sandbox escapes and kernel bugs - Project Zero
Posted by Ian Beer
A couple of weeks ago Apple released OS X 10.9.5 and iOS 8 which fixed a number of sandbox escapes and privilege escalation bugs found by Project Zero. All-bar-one of these bugs were found via manual source code auditing where there was source and binary analysis where there wasn’t. As always, click through the bugs for proof-of-concept code and further details:
CVE-2014-4403* [ https://code.google.com/p/google-security-research/issues/detail?id=23 ] was as issue allowing a kernel ASLR bypass on OS X due to insufficient randomization of very early kernel heap allocations, the addresses of which could be leaked using the unprivileged SGDT instruction. This bug could be exploited from within any sandbox on OS X and allowed an attacker to determine the load address of t
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
http://archives.neohapsis.com/archives/bugtraq/2014-09/0106.htmlhttp://archives.neohapsis.com/archives/bugtraq/2014-09/0107.htmlhttp://archives.neohapsis.com/archives/bugtraq/2014-10/0101.htmlhttp://support.apple.com/kb/HT6441http://support.apple.com/kb/HT6442http://www.securityfocus.com/bid/69882http://www.securityfocus.com/bid/69946http://www.securitytracker.com/id/1030866https://exchange.xforce.ibmcloud.com/vulnerabilities/96092https://support.apple.com/kb/HT6535http://archives.neohapsis.com/archives/bugtraq/2014-09/0106.htmlhttp://archives.neohapsis.com/archives/bugtraq/2014-09/0107.htmlhttp://archives.neohapsis.com/archives/bugtraq/2014-10/0101.htmlhttp://support.apple.com/kb/HT6441http://support.apple.com/kb/HT6442http://www.securityfocus.com/bid/69882http://www.securityfocus.com/bid/69946http://www.securitytracker.com/id/1030866https://exchange.xforce.ibmcloud.com/vulnerabilities/96092https://support.apple.com/kb/HT6535
2014-09-18
Published