CVE-2019-6224

published 2019-03-05

CVE-2019-6224: A buffer overflow issue was addressed with improved memory handling. This issue is fixed in iOS 12.1.3, macOS Mojave 10.14.3, tvOS 12.1.2, watchOS 5.1.3. A…

Priority P2 62 high 8.8 CVSS 3.0

AV N AC L PR N UI R S U C H I H A H

EXPLOIT

A buffer overflow issue was addressed with improved memory handling. This issue is fixed in iOS 12.1.3, macOS Mojave 10.14.3, tvOS 12.1.2, watchOS 5.1.3. A remote attacker may be able to initiate a FaceTime call causing arbitrary code execution.

Affected

12 ranges

Vendor	Product	Version range	Fixed in
apple	ios	—	—
apple	ios	>= unspecified < iOS 12.1.3	iOS 12.1.3
apple	iphone_os	< 12.1.3	12.1.3
apple	mac_os_x	< 10.14.3	10.14.3
apple	macos	>= unspecified < macOS Mojave 10.14.3	macOS Mojave 10.14.3
apple	macos_mojave_10.14.3_security_update_2019-001_high_sierra_security_update_2019-0	—	—
apple	tv_os	< 12.1.2	12.1.2
apple	tvos	—	—
apple	tvos	>= unspecified < tvOS 12.1.2	tvOS 12.1.2
apple	watchos	< 5.1.3	5.1.3
apple	watchos	—	—
apple	watchos	>= unspecified < watchOS 5.1.3	watchOS 5.1.3

Detection & IOCs extracted from sources · hover to see the quote

url https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/46433.zip↗

• → Monitor for unexpected dylib injection into AVConference.framework or IDSFoundation.framework binaries — the exploit patches these binaries to load malicious dylibs (/usr/lib/libSP.so and /usr/lib/libSP_IDS.so) via insert_dylib. ↗
• → Alert on creation or modification of files at /usr/lib/libSP.so or /usr/lib/libSP_IDS.so, which are non-standard dylib paths used by the exploit. ↗
• → Detect sandbox profile modification of com.apple.avconferenced.sb or com.apple.identityservicesd.sb to add permissive file-read*/file-write* rules, a prerequisite step in the exploit. ↗
• → The root cause is a buffer overflow in VCAudioRedBuilder_UpdateAudioPacketWithRedPayload triggered via _VCAudioReceiver_SplitRedPacket when processing malformed RTP RED (Redundant Audio Data) packets over FaceTime. Monitor for anomalous RTP traffic targeting FaceTime endpoints. ↗
• → Detect forced re-signing of system framework binaries (codesign -f -s -) applied to AVConference or IDSFoundation, which indicates tampering as part of exploit setup. ↗
• → The crash occurs in CVMetalTextureBacking::releaseBackingUsage() within CoreVideo, triggered by processing a malformed RTP video stream. Crash telemetry showing EXC_BAD_ACCESS (EXC_I386_GPFLT) in this function during a FaceTime call is a strong indicator of exploitation. ↗

• · The exploit requires manual sandbox profile modification and binary patching of system frameworks, making it a high-privilege, multi-step attack requiring local access to the attacker's own machine to set up the malicious FaceTime caller side. The victim only needs to accept the call. ↗
• · The exploit was tested on iOS 12.1.1 and Mac OS X 10.13.6 / 10.14.1; it affects FaceTime on iOS and Mac only (not tvOS/watchOS directly exploitable via this PoC). ↗

CVSS provenance

nvd v3.0 8.8 HIGH CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

nvd v2.0 6.8 MEDIUM AV:N/AC:M/Au:N/C:P/I:P/A:P

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-119