CVE-2018-4382

published 2019-04-03

CVE-2018-4382: Multiple memory corruption issues were addressed with improved memory handling. This issue affected versions prior to iOS 12.1, tvOS 12.1, watchOS 5.1, Safari…

Priority P2 58 high 8.8 CVSS 3.0

AV N AC L PR N UI R S U C H I H A H

EXPLOIT

Multiple memory corruption issues were addressed with improved memory handling. This issue affected versions prior to iOS 12.1, tvOS 12.1, watchOS 5.1, Safari 12.0.1, iTunes 12.9.1, iCloud for Windows 7.8.

Affected

13 ranges

Vendor	Product	Version range	Fixed in
apple	icloud	< 7.8	7.8
apple	icloud_for_windows	—	—
apple	ios	—	—
apple	iphone_os	< 12.1	12.1
apple	itunes	< 12.9.1	12.9.1
apple	itunes_12.9.1_for_windows	—	—
apple	safari	< 12.0.1	12.0.1
apple	safari	—	—
apple	tvos	< 12.1	12.1
apple	tvos	—	—
apple	watchos	< 5.1	5.1
apple	watchos	—	—
debian	webkit2gtk	< webkit2gtk 2.22.1-1 (bookworm)	webkit2gtk 2.22.1-1 (bookworm)

Detection & IOCs extracted from sources · hover to see the quote

command Array.prototype.__defineGetter__('a', Array.prototype.push);↗

• → Trigger pattern: a getter on Array.prototype is defined using __defineGetter__ pointing to Array.prototype.push, then a JIT-compiled function accesses the getter via a computed property (e.g., arr['a' + '']) on an Array instance iterated >1000 times to trigger JIT compilation — look for this pattern in JavaScript engine telemetry or script content inspection. ↗
• → Root cause is in WebKit's ByteCodeParser::handleIntrinsicCall — the ArrayPushIntrinsic handler (and similarly ArraySliceIntrinsic, ArrayIndexOfIntrinsic, ArrayPopIntrinsic) incorrectly assumes the current instruction is always op_call, but can be reached via op_get_by_id or op_get_by_val (getter path), causing type confusion and OOB read. Detection should flag JIT paths where array intrinsics are invoked through getter dispatch. ↗
• → Exploitation vector is 'processing maliciously crafted web content' leading to arbitrary code execution via WebKit — monitor for suspicious web content delivery targeting WebKit-based browsers/apps on unpatched iOS <12.1, tvOS <12.1, watchOS <5.1, Safari <12.0.1, iTunes <12.9.1, iCloud for Windows <7.8. ↗

• · The vulnerability is a JIT compiler type confusion — it only triggers after sufficient JIT compilation iterations (loop threshold ~1000). Detection based solely on static script content may miss obfuscated or split variants that achieve the same JIT path through different surface syntax. ↗
• · The same vulnerable code pattern exists in four intrinsic handlers (ArrayPushIntrinsic, ArraySliceIntrinsic, ArrayIndexOfIntrinsic, ArrayPopIntrinsic), meaning detection rules should not be limited to Array.prototype.push getter abuse alone. ↗

CVSS provenance

nvd v3.0 8.8 HIGH CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

nvd v2.0 6.8 MEDIUM AV:N/AC:M/Au:N/C:P/I:P/A:P

osv 8.8 HIGH

vendor_debian 8.8 LOW

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-119