CVE-2018-4441
published 2019-04-03CVE-2018-4441: A memory corruption issue was addressed with improved memory handling. This issue affected versions prior to iOS 12.1.1, tvOS 12.1.1, watchOS 5.1.2, Safari…
PriorityP264high8.8CVSS 3.0
AVNACLPRNUIRSUCHIHAH
EXPLOIT
EPSS
12.81%
95.9th percentile
A memory corruption issue was addressed with improved memory handling. This issue affected versions prior to iOS 12.1.1, tvOS 12.1.1, watchOS 5.1.2, Safari 12.0.2, iTunes 12.9.2 for Windows, iCloud for Windows 7.9.
Affected
13 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apple | icloud | < 7.9 | 7.9 |
| apple | icloud_for_windows | — | — |
| apple | ios | — | — |
| apple | iphone_os | < 12.1.1 | 12.1.1 |
| apple | itunes | < 12.9.2 | 12.9.2 |
| apple | itunes_12.9.2_for_windows | — | — |
| apple | safari | < 12.0.2 | 12.0.2 |
| apple | safari | — | — |
| apple | tvos | < 12.1.1 | 12.1.1 |
| apple | tvos | — | — |
| apple | watchos | < 5.1.2 | 5.1.2 |
| apple | watchos | — | — |
| debian | webkit2gtk | < webkit2gtk 2.22.3-1 (bookworm) | webkit2gtk 2.22.3-1 (bookworm) |
Detection & IOCsextracted from sources · hover to see the quote
commandarr.length = 0x100000; arr.splice(0, 0x11); arr.length = 0xfffffff0; arr.splice(0xfffffff0, 0, 1);↗
- →Detect JavaScript triggering the CVE-2018-4441 OOB via JSArray::shiftCountWithArrayStorage: look for array splice operations that set array length to 0xfffffff0 followed by a splice at offset 0xfffffff0, which manipulates m_numValuesInVector to an attacker-controlled value (0xfffffff0) enabling OOB read/write. ↗
- →The exploit uses a ROP chain for code execution (userland only on PS4); presence of files named rop.js, syscalls.js, and wkexploit.js served together from the same web root is a strong indicator of this exploit kit. ↗
- →The vulnerability is in WebKit's JSC (JavaScriptCore); processing maliciously crafted web content triggers the memory corruption. Flag WebKit/JSC crashes or unexpected memory access violations originating from array splice operations on large sparse arrays. ↗
- ·The exploit as published targets PS4 firmware 6.20 specifically; gadget offsets must be ported for lower firmware versions, and the p.launchchain() code execution method may also need to be changed. ↗
- ·The exploit only achieves userland code execution on PS4; it is not a kernel exploit or jailbreak, so post-exploitation capability is limited to userland syscalls. ↗
- ·Exploit stability degrades when many objects are added into the exploit; the published syscalls.js intentionally contains only a small number of system calls to preserve stability. ↗
- ·The OOB condition requires that holesMustForwardToPrototype returns false (i.e., no indexed accessors or Proxy objects in the prototype chain); arrays with such prototype chain properties will not be exploitable via this path. ↗
CVSS provenance
nvdv3.08.8HIGHCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
nvdv2.06.8MEDIUMAV:N/AC:M/Au:N/C:P/I:P/A:P
osv8.8HIGH
vendor_debian8.8LOW
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-8pj8-v43j-qvjx: A memory corruption issue was addressed with improved memory handling
ghsa_unreviewed·2022-05-14
CVE-2018-4441 [HIGH] CWE-119 GHSA-8pj8-v43j-qvjx: A memory corruption issue was addressed with improved memory handling
A memory corruption issue was addressed with improved memory handling. This issue affected versions prior to iOS 12.1.1, tvOS 12.1.1, watchOS 5.1.2, Safari 12.0.2, iTunes 12.9.2 for Windows, iCloud for Windows 7.9.
OSV
CVE-2018-4441: A memory corruption issue was addressed with improved memory handling
osv·2019-04-03·CVSS 8.8
CVE-2018-4441 [HIGH] CVE-2018-4441: A memory corruption issue was addressed with improved memory handling
A memory corruption issue was addressed with improved memory handling. This issue affected versions prior to iOS 12.1.1, tvOS 12.1.1, watchOS 5.1.2, Safari 12.0.2, iTunes 12.9.2 for Windows, iCloud for Windows 7.9.
Apple
CVE-2018-4441: watchOS 5.1.2
vendor_apple·2018-12-06·CVSS 8.8
CVE-2018-4441 [HIGH] CVE-2018-4441: watchOS 5.1.2
Apple Security Update: About the security content of watchOS 5.1.2
Product: watchOS
Version: 5.1.2
CVE: CVE-2018-4441
Component: WebKit
Impact: Processing maliciously crafted web content may lead to arbitrary code execution
Description: A memory corruption issue was addressed with improved memory handling.
Apple
CVE-2018-4441: iOS 12.1.1
vendor_apple·2018-12-05·CVSS 8.8
CVE-2018-4441 [HIGH] CVE-2018-4441: iOS 12.1.1
Apple Security Update: About the security content of iOS 12.1.1
Product: iOS
Version: 12.1.1
CVE: CVE-2018-4441
Component: WebKit
Impact: Processing maliciously crafted web content may lead to arbitrary code execution
Description: A memory corruption issue was addressed with improved memory handling.
Apple
CVE-2018-4441: tvOS 12.1.1
vendor_apple·2018-12-05·CVSS 8.8
CVE-2018-4441 [HIGH] CVE-2018-4441: tvOS 12.1.1
Apple Security Update: About the security content of tvOS 12.1.1
Product: tvOS
Version: 12.1.1
CVE: CVE-2018-4441
Component: WebKit
Impact: Processing maliciously crafted web content may lead to arbitrary code execution
Description: A memory corruption issue was addressed with improved memory handling.
Apple
CVE-2018-4441: Safari 12.0.2
vendor_apple·2018-12-05·CVSS 8.8
CVE-2018-4441 [HIGH] CVE-2018-4441: Safari 12.0.2
Apple Security Update: About the security content of Safari 12.0.2
Product: Safari
Version: 12.0.2
CVE: CVE-2018-4441
Component: WebKit
Impact: Processing maliciously crafted web content may lead to arbitrary code execution
Description: A memory corruption issue was addressed with improved memory handling.
Apple
CVE-2018-4441: iCloud for Windows 7.9
vendor_apple·2018-12-05·CVSS 8.8
CVE-2018-4441 [HIGH] CVE-2018-4441: iCloud for Windows 7.9
Apple Security Update: About the security content of iCloud for Windows 7.9
Product: iCloud for Windows
Version: 7.9
CVE: CVE-2018-4441
Component: WebK it
Impact: Processing maliciously crafted web content may lead to arbitrary code execution
Description: A memory corruption issue was addressed with improved memory handling.
Apple
CVE-2018-4441: iTunes 12.9.2 for Windows
vendor_apple·2018-12-05·CVSS 8.8
CVE-2018-4441 [HIGH] CVE-2018-4441: iTunes 12.9.2 for Windows
Apple Security Update: About the security content of iTunes 12.9.2 for Windows
Product: iTunes 12.9.2 for Windows
CVE: CVE-2018-4441
Component: WebKit
Impact: Processing maliciously crafted web content may lead to arbitrary code execution
Description: A memory corruption issue was addressed with improved memory handling.
Debian
CVE-2018-4441: webkit2gtk - A memory corruption issue was addressed with improved memory handling. This issu...
vendor_debian·2018·CVSS 8.8
CVE-2018-4441 [HIGH] CVE-2018-4441: webkit2gtk - A memory corruption issue was addressed with improved memory handling. This issu...
A memory corruption issue was addressed with improved memory handling. This issue affected versions prior to iOS 12.1.1, tvOS 12.1.1, watchOS 5.1.2, Safari 12.0.2, iTunes 12.9.2 for Windows, iCloud for Windows 7.9.
Scope: local
bookworm: resolved (fixed in 2.22.3-1)
bullseye: resolved (fixed in 2.22.3-1)
forky: resolved (fixed in 2.22.3-1)
sid: resolved (fixed in 2.22.3-1)
trixie: resolved (fixed in 2.22.3-1)
No detection rules found.
Exploit-DB
Sony Playstation 4 (PS4) < 6.20 - WebKit Code Execution (PoC)
exploitdb·2019-03-08·CVSS 8.8
CVE-2018-4441 [HIGH] Sony Playstation 4 (PS4) < 6.20 - WebKit Code Execution (PoC)
Sony Playstation 4 (PS4) code execution.
* `rop.js` - Contains a framework for ROP chains.
* `syscalls.js` - Contains an (incomplete) list of system calls to use for post-exploit stuff.
* `wkexploit.js` - Contains the heart of the WebKit exploit.
Notes
* This vulnerability was patched in 6.50 firmware!
* This only gives you code execution in **userland**. This is **not** a jailbreak nor a kernel exploit, it is only the first half.
* This exploit targets firmware 6.20. It should work on lower firmwares however the gadgets will need to be ported, and the `p.launchchain()` method for code execution may need to be swapped out.
* In my tests the exploit as-is is pretty stable, but it can become less stable if you add a lot of objects and such into the exploit. This is part of the reason why
Exploit-DB
WebKit JSC - 'JSArray::shiftCountWithArrayStorage' Out-of-Bounds Read/Write
exploitdb·2019-01-02
CVE-2018-4441 WebKit JSC - 'JSArray::shiftCountWithArrayStorage' Out-of-Bounds Read/Write
WebKit JSC - 'JSArray::shiftCountWithArrayStorage' Out-of-Bounds Read/Write
---
/*
bool JSArray::shiftCountWithArrayStorage(VM& vm, unsigned startIndex, unsigned count, ArrayStorage* storage)
{
unsigned oldLength = storage->length();
RELEASE_ASSERT(count hasHoles() && this->structure(vm)->holesMustForwardToPrototype(vm, this))
|| hasSparseMap()
|| shouldUseSlowPut(indexingType())) {
return false;
}
if (!oldLength)
return true;
unsigned length = oldLength - count;
storage->m_numValuesInVector -= count;
storage->setLength(length);
Considering the comment, I think the method is supposed to prevent an array with holes from going through to the code "storage->m_numValuesInVector -= count". But that kind of arrays actually can get there by only having the holesMustForwardToPrototype metho
https://support.apple.com/kb/HT209340https://support.apple.com/kb/HT209342https://support.apple.com/kb/HT209343https://support.apple.com/kb/HT209344https://support.apple.com/kb/HT209345https://support.apple.com/kb/HT209346https://support.apple.com/kb/HT209340https://support.apple.com/kb/HT209342https://support.apple.com/kb/HT209343https://support.apple.com/kb/HT209344https://support.apple.com/kb/HT209345https://support.apple.com/kb/HT209346
2019-04-03
Published