CVE-2019-6215

published 2019-03-05

CVE-2019-6215: A type confusion issue was addressed with improved memory handling. This issue is fixed in iOS 12.1.3, tvOS 12.1.2, Safari 12.0.3, iTunes 12.9.3 for Windows…

Priority P2 66 high 8.8 CVSS 3.0

AV N AC L PR N UI R S U C H I H A H

EXPLOIT

A type confusion issue was addressed with improved memory handling. This issue is fixed in iOS 12.1.3, tvOS 12.1.2, Safari 12.0.3, iTunes 12.9.3 for Windows, iCloud for Windows 7.10. Processing maliciously crafted web content may lead to arbitrary code execution.

Affected

19 ranges

Vendor	Product	Version range	Fixed in
apple	icloud	< 7.10	7.10
apple	icloud_for_windows	—	—
apple	icloud_for_windows	>= unspecified < iCloud for Windows 7.10	iCloud for Windows 7.10
apple	ios	—	—
apple	ios	>= unspecified < iOS 12.1.3	iOS 12.1.3
apple	iphone_os	< 12.1.3	12.1.3
apple	itunes	< 12.9.3	12.9.3
apple	itunes_12.9.3_for_windows	—	—
apple	itunes_for_windows	>= unspecified < iTunes 12.9.3 for Windows	iTunes 12.9.3 for Windows
apple	safari	< 12.0.3	12.0.3
apple	safari	—	—
apple	safari	>= unspecified < Safari 12.0.3	Safari 12.0.3
apple	tvos	< 12.1.2	12.1.2
apple	tvos	—	—
apple	tvos	>= unspecified < tvOS 12.1.2	tvOS 12.1.2
apple	watchos	< 5.1.3	5.1.3
canonical	ubuntu_linux	—	—
canonical	ubuntu_linux	—	—
debian	webkit2gtk	< webkit2gtk 2.22.6-1 (bookworm)	webkit2gtk 2.22.6-1 (bookworm)

Detection & IOCs extracted from sources · hover to see the quote

command function opt(o) { return o.r.input; } Object.assign({}, RegExp); for (let i = 0; i < 200000; i++) { opt({r: RegExp}); } let input = opt({r: RegExp});↗

• → The exploit triggers JIT compilation via a hot loop (~200,000 iterations) calling a property accessor on RegExp to pull a CustomGetterSetter object into JavaScript scope — monitor for high-iteration JIT-triggering loops accessing RegExp.input in WebKit/JavaScriptCore contexts. ↗
• → The exploit abuses `Object.assign({}, RegExp)` to reify static properties on the RegExp constructor, which is the prerequisite step before the type confusion — flag unusual Object.assign calls targeting built-in constructors like RegExp. ↗
• → The type confusion arises from a mismatch between property value type (CustomGetterSetter) and its attributes as seen by the JIT vs. the interpreter — the JIT compiler sees attributes while the normal interpreter sees the value type, enabling the CustomGetterSetter object to be leaked to JavaScript. ↗
• → The PoC demonstrates an OOB read via a CustomGetterSetter object linked to regExpConstructorInput — look for anomalous reads/accesses on RegExp.input after JIT warm-up in WebKit process memory. ↗

• · The vulnerability exists in WebKit's JSC reifyStaticProperty function, which fails to set the PropertyAttribute::CustomAccessor flag for CustomGetterSetter — exploitation requires processing maliciously crafted web content, so attack surface is browser/WebView-based. ↗
• · Fixed versions are iOS 12.1.3, tvOS 12.1.2, Safari 12.0.3, iTunes 12.9.3 for Windows, iCloud for Windows 7.10, and WebKitGTK+ 2.22.6-1 — detections should focus on unpatched instances of these products. ↗

CVSS provenance

nvd v3.0 8.8 HIGH CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

nvd v2.0 6.8 MEDIUM AV:N/AC:M/Au:N/C:P/I:P/A:P

osv 8.8 HIGH

vendor_debian 8.8 LOW

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-843