CVE-2018-4206
published 2018-06-08CVE-2018-4206: An issue was discovered in certain Apple products. iOS before 11.3.1 is affected. macOS before 10.13.4 Security Update 2018-001 is affected. tvOS before 11.4…
PriorityP352high7.8CVSS 3.0
AVLACLPRNUIRSUCHIHAH
EXPLOIT
EPSS
4.98%
91.2th percentile
An issue was discovered in certain Apple products. iOS before 11.3.1 is affected. macOS before 10.13.4 Security Update 2018-001 is affected. tvOS before 11.4 is affected. watchOS before 4.3.1 is affected. The issue involves the "Crash Reporter" component. It allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted app that replaces a privileged port name.
Affected
8 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apple | apple_tv | < 11.4 | 11.4 |
| apple | ios | — | — |
| apple | iphone_os | < 11.3.1 | 11.3.1 |
| apple | mac_os_x | < 10.13.4 | 10.13.4 |
| apple | security_update_2018-001 | — | — |
| apple | tvos | — | — |
| apple | watchos | < 4.3.1 | 4.3.1 |
| apple | watchos | — | — |
CVSS provenance
nvdv3.07.8HIGHCVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
nvdv2.06.8MEDIUMAV:N/AC:M/Au:N/C:P/I:P/A:P
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Apple
CVE-2018-4206: tvOS 11.4
vendor_apple·2018-05-29·CVSS 7.8
CVE-2018-4206 [HIGH] CVE-2018-4206: tvOS 11.4
Apple Security Update: About the security content of tvOS 11.4
Product: tvOS
Version: 11.4
CVE: CVE-2018-4206
Component: Crash Reporter
Impact: An application may be able to gain elevated privileges
Description: A memory corruption issue was addressed with improved error handling.
Apple
CVE-2018-4206: watchOS 4.3.1
vendor_apple·2018-05-29·CVSS 7.8
CVE-2018-4206 [HIGH] CVE-2018-4206: watchOS 4.3.1
Apple Security Update: About the security content of watchOS 4.3.1
Product: watchOS
Version: 4.3.1
CVE: CVE-2018-4206
Component: Crash Reporter
Impact: An application may be able to gain elevated privileges
Description: A memory corruption issue was addressed with improved error handling.
Apple
CVE-2018-4206: iOS 11.3.1
vendor_apple·2018-04-24·CVSS 7.8
CVE-2018-4206 [HIGH] CVE-2018-4206: iOS 11.3.1
Apple Security Update: About the security content of iOS 11.3.1
Product: iOS
Version: 11.3.1
CVE: CVE-2018-4206
Component: Crash Reporter
Impact: An application may be able to gain elevated privileges
Description: A memory corruption issue was addressed with improved error handling.
Apple
CVE-2018-4206: Security Update 2018-001
vendor_apple·2018-04-24·CVSS 7.8
CVE-2018-4206 [HIGH] CVE-2018-4206: Security Update 2018-001
Apple Security Update: About the security content of Security Update 2018-001
Product: Security Update 2018-001
CVE: CVE-2018-4206
Component: Crash Reporter
Impact: An application may be able to gain elevated privileges
Description: A memory corruption issue was addressed with improved error handling.
GHSA
GHSA-c95p-mvpw-c6w9: An issue was discovered in certain Apple products
ghsa_unreviewed·2022-05-14
CVE-2018-4206 [HIGH] CWE-119 GHSA-c95p-mvpw-c6w9: An issue was discovered in certain Apple products
An issue was discovered in certain Apple products. iOS before 11.3.1 is affected. macOS before 10.13.4 Security Update 2018-001 is affected. tvOS before 11.4 is affected. watchOS before 4.3.1 is affected. The issue involves the "Crash Reporter" component. It allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted app that replaces a privileged port name.
No detection rules found.
Exploit-DB
iOS/macOS - 'task_swap_mach_voucher()' Use-After-Free
exploitdb·2019-01-25·CVSS 7.8
CVE-2019-6225 [HIGH] iOS/macOS - 'task_swap_mach_voucher()' Use-After-Free
iOS/macOS - 'task_swap_mach_voucher()' Use-After-Free
---
/*
* voucher_swap-poc.c
* Brandon Azad
*/
#if 0
iOS/macOS: task_swap_mach_voucher() does not respect MIG semantics leading to use-after-free
The dangers of not obeying MIG semantics have been well documented: see issues 926 (CVE-2016-7612),
954 (CVE-2016-7633), 1417 (CVE-2017-13861, async_wake), 1520 (CVE-2018-4139), 1529 (CVE-2018-4206),
and 1629 (no CVE), as well as CVE-2018-4280 (blanket). However, despite numerous fixes and
mitigations, MIG issues persist and offer incredibly powerful exploit primitives. Part of the
problem is that MIG semantics are complicated and unintuitive and do not align well with the
kernel's abstractions.
Consider the MIG routine task_swap_mach_voucher():
routine task_swap_mach_voucher(
task : task_
Exploit-DB
Apple macOS/iOS - ReportCrash mach port Replacement due to Failure to Respect MIG Ownership Rules
exploitdb·2018-04-30
CVE-2018-4206 Apple macOS/iOS - ReportCrash mach port Replacement due to Failure to Respect MIG Ownership Rules
Apple macOS/iOS - ReportCrash mach port Replacement due to Failure to Respect MIG Ownership Rules
---
/*
ReportCrash is the daemon responsible for making crash dumps of crashing userspace processes.
Most processes can talk to ReportCrash via their exception ports (either task or host level.)
You would normally never send a message yourself to ReportCrash but the kernel would do it
on your behalf when you crash. However using the task_get_exception_ports or host_get_exception_ports
MIG kernel methods you can get a send right to ReportCrash.
ReportCrash implements a mach_exc subsystem (2405) server and expects to receive
mach_exception_raise_state_identity messages. The handler for these messages is at +0x2b11 in 10.13.3.
The handler compares its euid with the sender's; if they are diff
No writeups or analysis indexed.
http://www.securityfocus.com/bid/103957http://www.securityfocus.com/bid/103958http://www.securitytracker.com/id/1040744https://bugs.chromium.org/p/project-zero/issues/detail?id=1529https://support.apple.com/HT208742https://support.apple.com/HT208743https://support.apple.com/HT208850https://support.apple.com/HT208851https://www.exploit-db.com/exploits/44562/http://www.securityfocus.com/bid/103957http://www.securityfocus.com/bid/103958http://www.securitytracker.com/id/1040744https://bugs.chromium.org/p/project-zero/issues/detail?id=1529https://support.apple.com/HT208742https://support.apple.com/HT208743https://support.apple.com/HT208850https://support.apple.com/HT208851https://www.exploit-db.com/exploits/44562/
2018-06-08
Published