CVE-2018-4443

published 2019-04-03

CVE-2018-4443: A memory corruption issue was addressed with improved memory handling. This issue affected versions prior to iOS 12.1.1, tvOS 12.1.1, watchOS 5.1.2, Safari…

Priority P1 79 high 8.8 CVSS 3.0

AV N AC L PR N UI R S U C H I H A H

ITW EXPLOIT VulnCheck KEV

A memory corruption issue was addressed with improved memory handling. This issue affected versions prior to iOS 12.1.1, tvOS 12.1.1, watchOS 5.1.2, Safari 12.0.2, iTunes 12.9.2 for Windows, iCloud for Windows 7.9.

Affected

13 ranges

Vendor	Product	Version range	Fixed in
apple	icloud	< 7.9	7.9
apple	icloud_for_windows	—	—
apple	ios	—	—
apple	iphone_os	< 12.1.1	12.1.1
apple	itunes	< 12.9.2	12.9.2
apple	itunes_12.9.2_for_windows	—	—
apple	safari	< 12.0.2	12.0.2
apple	safari	—	—
apple	tvos	< 12.1.1	12.1.1
apple	tvos	—	—
apple	watchos	< 5.1.2	5.1.2
apple	watchos	—	—
debian	webkit2gtk	< webkit2gtk 2.22.3-1 (bookworm)	webkit2gtk 2.22.3-1 (bookworm)

Detection & IOCs extracted from sources · hover to see the quote

command ./jsc --useConcurrentJIT=false ~/test.js↗

• → The vulnerability is triggered via maliciously crafted web content processed by WebKit's JSC (JavaScriptCore). Look for exploitation attempts involving CoW (Copy-on-Write) array manipulation in JavaScript — specifically writing to index 0 of an array that should be immutable (JSImmutableButterfly), which can bypass write barriers and lead to Use-After-Free. ↗
• → The root cause is in WebKit's AbstractValue::set using structure->indexingType() instead of structure->indexingMode(), masking the CopyOnWrite flag. Detection engineering should flag WebKit/JSC builds prior to the patched versions (Safari 12.0.2, iOS 12.1.1, tvOS 12.1.1, watchOS 5.1.2, iTunes 12.9.2 for Windows, iCloud for Windows 7.9) as vulnerable. ↗
• → Processing maliciously crafted web content is the attack vector. Monitor for WebKit-based browser processes (Safari, WebView in iTunes/iCloud on Windows) spawning unexpected child processes or exhibiting memory corruption crash signatures (e.g., SIGSEGV/access violations in JavaScriptCore). ↗

• · The PoC requires --useConcurrentJIT=false to be passed to JSC to reproduce reliably; real-world exploitation may require different JIT configuration or timing conditions. ↗
• · The exploit uses a sleep/busy-wait loop and a setTimeout delay, suggesting timing-dependent exploitation; detection based purely on static JS patterns may miss obfuscated variants. ↗

CVSS provenance

nvd v3.0 8.8 HIGH CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

nvd v2.0 6.8 MEDIUM AV:N/AC:M/Au:N/C:P/I:P/A:P

osv 8.8 HIGH

vulncheck 8.8 HIGH

vendor_debian 8.8 LOW

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-119