CVE-2019-7286
published 2019-12-18CVE-2019-7286: A memory corruption issue was addressed with improved input validation. This issue is fixed in iOS 12.1.4, macOS Mojave 10.14.3 Supplemental Update. An…
PriorityP181high7.8CVSS 3.1
AVLACLPRNUIRSUCHIHAH
KEVITWEXPLOIT
CISA Known Exploited Vulnerabilitydue 2022-06-13
Exploited in the wild
EPSS
15.71%
96.5th percentile
A memory corruption issue was addressed with improved input validation. This issue is fixed in iOS 12.1.4, macOS Mojave 10.14.3 Supplemental Update. An application may be able to gain elevated privileges.
Affected
8 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apple | ios | — | — |
| apple | ios | >= unspecified < iOS 12.1.4 | iOS 12.1.4 |
| apple | iphone_os | < 12.1.4 | 12.1.4 |
| apple | mac_os_x | < 10.14.3 | 10.14.3 |
| apple | macos | >= unspecified < macOS Mojave 10.14.3 Supplemental Update | macOS Mojave 10.14.3 Supplemental Update |
| apple | macos_mojave_10.14.3_supplemental_update | — | — |
| apple | tvos | — | — |
| apple | watchos | — | — |
Detection & IOCsextracted from sources · hover to see the quote
- →Alert on cfprefsd spawning child processes or exhibiting privilege escalation (e.g., setuid/setgid calls) following receipt of malformed XPC messages — the exploit targets cfprefsd to gain elevated privileges. ↗
- →This CVE is listed in CISA KEV as actively exploited in the wild; treat any unpatched iOS < 12.1.4 or macOS < 10.14.3 Supplemental Update device as high-priority for incident investigation. ↗
- ·The fake_cache_bucket.cached_sel address is computed at runtime as 0x7fff00000000 + NSSelectorFromString(@"dealloc"), making the exact selector address variable across runs and OS versions; static byte signatures for this field will not be reliable. ↗
CVSS provenance
nvdv3.17.8HIGHCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
nvdv2.06.8MEDIUMAV:N/AC:M/Au:N/C:P/I:P/A:P
vulncheck7.8HIGH
cisa7.8HIGH
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-7c5f-gfr7-vw4v: A memory corruption issue was addressed with improved input validation
ghsa_unreviewed·2022-05-24
CVE-2019-7286 [MEDIUM] CWE-787 GHSA-7c5f-gfr7-vw4v: A memory corruption issue was addressed with improved input validation
A memory corruption issue was addressed with improved input validation. This issue is fixed in iOS 12.1.4, macOS Mojave 10.14.3 Supplemental Update. An application may be able to gain elevated privileges.
Project0
Root Cause Analyses for 0-day In-the-Wild Exploits - Project Zero
project_zero·2020-07-01
CVE-2019-1107 Root Cause Analyses for 0-day In-the-Wild Exploits - Project Zero
Posted by Maddie Stone, Project Zero
When a 0-day is exploited in the wild AND it is detected, we need to use that as an opportunity to learn as much as possible about the vulnerability and the exploit if we hope to make 0-day hard. One of the main methods to do that is to perform a root cause analysis (RCA) on the 0-day.
Our effort on this began in earnest in the last quarter of 2019. Today we are beginning to publish the root cause analyses for 0-days exploited in the wild that we have completed. While we’re publishing some in bulk now to play “catch-up”, in the future we plan to post each one in a timely manner after it’s detected and disclosed. We think publishing technical details in a timely manner is important for transparency and so that the whole of the security community can
Project0
Detection Deficit: A Year in Review of 0-days Used In-The-Wild in 2019 - Project Zero
project_zero·2020-07-01
CVE-2016-5195 Detection Deficit: A Year in Review of 0-days Used In-The-Wild in 2019 - Project Zero
Posted by Maddie Stone, Project Zero
In May 2019, Project Zero released our tracking spreadsheet for 0-days used “in the wild” and we started a more focused effort on analyzing and learning from these exploits. This is another way Project Zero is trying to make zero-day hard. This blog post synthesizes many of our efforts and what we’ve seen over the last year. We provide a review of what we can learn from 0-day exploits detected as used in the wild in 2019. In conjunction with this blog post, we are also publishing another blog post today about our root cause analysis work that informed the conclusions in this Year in Review. We are also releasing 8 root cause analyses that we have done for in-the-wild 0-days from 2019.
When I had the idea for this “Year in Review” blog post, I immedi
Project0
A very deep dive into iOS Exploit chains found in the wild - Project Zero
project_zero·2019-08-01·CVSS 7.8
CVE-2019-7286 [HIGH] A very deep dive into iOS Exploit chains found in the wild - Project Zero
Posted by Ian Beer, Project Zero
Project Zero’s mission is to make 0-day hard. We often work with other companies to find and report security vulnerabilities, with the ultimate goal of advocating for structural security improvements in popular systems to help protect people everywhere.
Earlier this year Google's Threat Analysis Group (TAG) discovered a small collection of hacked websites. The hacked sites were being used in indiscriminate watering hole attacks against their visitors, using iPhone 0-day.
There was no target discrimination; simply visiting the hacked site was enough for the exploit server to attack your device, and if it was successful, install a monitoring implant. We estimate that these sites receive thousands of visitors per week.
TAG was able to collect five sepa
VulnCheck
Apple Multiple Products Memory Corruption Vulnerability
vulncheck·2019·CVSS 7.8
CVE-2019-7286 [HIGH] CWE-787 Apple Multiple Products Memory Corruption Vulnerability
Apple Multiple Products Memory Corruption Vulnerability
Apple iOS, macOS, watchOS, and tvOS contain a memory corruption vulnerability that could allow for privilege escalation.
Affected: Apple Multiple Products
Required Action: Apply updates per vendor instructions.
Exploitation References: https://docs.google.com/spreadsheets/d/1lkNJ0uQwbeC1ZTRrxdtuPLCIl7mlUreoKfSIgajnSyY/edit; https://twitter.com/benhawkes/status/1093581737924259840; https://www.eweek.com/security/apple-patches-facetime-vulnerability-in-ios-macos-updates/; https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
Remediation Due: 2022-06-13
Project0
Project Zero RCA: CVE-2019-7286: iOS use-after-free in cfprefsd
project_zero·CVSS 7.8
CVE-2019-7286 [HIGH] Project Zero RCA: CVE-2019-7286: iOS use-after-free in cfprefsd
# CVE-2019-7286: iOS use-after-free in cfprefsd
*Ian Beer, Project Zero (Originally posted on [Project Zero blog](https://googleprojectzero.blogspot.com/p/rca.html) 2020-07-27)*
## The Basics
**Disclosure or Patch Date:** 7 February 2019
**Product:** Apple iOS
**Advisory:** https://support.apple.com/en-us/HT209520
**Affected Versions:** Exploit targeted iOS 12-12.1
**First Patched Version:** iOS 12.1.4
**Issue/Bug Report:** N/A
**Patch CL:** N/A
**Bug-Introducing CL:** N/A
**Reporter(s):** Clement Lecigne of Google's Threat Analysis Group (TAG), Ian Beer & Samuel Groß of Google Project Zero, & an anonymous researcher (according to [Apple's release notes](https://support.apple.com/en-us/HT209520))
## The Code
**Proof-of-concept:** N/A
**Exploit sample:** N/A
**Did you have acc
Project0
Project Zero RCA: CVE-2019-7287: iOS Buffer Overflow in ProvInfoIOKitUserClient
project_zero·CVSS 7.8
CVE-2019-7287 [HIGH] Project Zero RCA: CVE-2019-7287: iOS Buffer Overflow in ProvInfoIOKitUserClient
# CVE-2019-7287: iOS Buffer Overflow in ProvInfoIOKitUserClient
*Ian Beer, Project Zero (Originally posted on [Project Zero blog](https://googleprojectzero.blogspot.com/p/rca.html) 2020-07-27)*
## The Basics
**Disclosure or Patch Date:** 7 February 2019
**Product:** Apple iOS
**Advisory:** https://support.apple.com/en-us/HT209520
**Affected Versions:** iOS 10-12.1.3
**First Patched Version:** iOS 12.1.4
**Issue/Bug Report:** N/A
**Patch CL:** N/A
**Bug-Introducing CL:** N/A
**Reporter(s):** Clement Lecigne of Google's Threat Analysis Group (TAG), Ian Beer & Samuel Groß of Google Project Zero, & an anonymous researcher (according to [Apple's release notes](https://support.apple.com/en-us/HT209520))
## The Code
**Proof-of-concept:** N/A
**Exploit sample:** N/A
**Did you have ac
CISA
Apple Multiple Products Memory Corruption Vulnerability
cisa·2022-05-23·CVSS 7.8
CVE-2019-7286 [HIGH] CWE-787 Apple Multiple Products Memory Corruption Vulnerability
Vulnerability: Apple Multiple Products Memory Corruption Vulnerability
Affected: Apple Multiple Products
Apple iOS, macOS, watchOS, and tvOS contain a memory corruption vulnerability that could allow for privilege escalation.
Required Action: Apply updates per vendor instructions.
Notes: https://nvd.nist.gov/vuln/detail/CVE-2019-7286
Remediation Due Date: 2022-06-13
Apple
CVE-2019-7286: watchOS 5.2
vendor_apple·2019-03-27·CVSS 7.8
CVE-2019-7286 [HIGH] CVE-2019-7286: watchOS 5.2
Apple Security Update: About the security content of watchOS 5.2
Product: watchOS
Version: 5.2
CVE: CVE-2019-7286
Component: Foundation
Impact: An application may be able to gain elevated privileges
Description: A memory corruption issue was addressed with improved input validation.
Apple
CVE-2019-7286: tvOS 12.2
vendor_apple·2019-03-25·CVSS 7.8
CVE-2019-7286 [HIGH] CVE-2019-7286: tvOS 12.2
Apple Security Update: About the security content of tvOS 12.2
Product: tvOS
Version: 12.2
CVE: CVE-2019-7286
Component: Foundation
Impact: An application may be able to gain elevated privileges
Description: A memory corruption issue was addressed with improved input validation.
Apple
CVE-2019-7286: iOS 12.1.4
vendor_apple·2019-02-07·CVSS 7.8
CVE-2019-7286 [HIGH] CVE-2019-7286: iOS 12.1.4
Apple Security Update: About the security content of iOS 12.1.4
Product: iOS
Version: 12.1.4
CVE: CVE-2019-7286
Component: Foundation
Impact: An application may be able to gain elevated privileges
Description: A memory corruption issue was addressed with improved input validation.
Apple
CVE-2019-7286: macOS Mojave 10.14.3 Supplemental Update
vendor_apple·2019-02-07·CVSS 7.8
CVE-2019-7286 [HIGH] CVE-2019-7286: macOS Mojave 10.14.3 Supplemental Update
Apple Security Update: About the security content of macOS Mojave 10.14.3 Supplemental Update
Product: macOS Mojave 10.14.3 Supplemental Update
CVE: CVE-2019-7286
Component: Foundation
Impact: An application may be able to gain elevated privileges
Description: A memory corruption issue was addressed with improved input validation.
No detection rules found.
No writeups or analysis indexed.
https://support.apple.com/HT209520https://support.apple.com/HT209521https://support.apple.com/HT209601https://support.apple.com/HT209602https://support.apple.com/HT209520https://support.apple.com/HT209521https://support.apple.com/HT209601https://support.apple.com/HT209602https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-7286
2019-12-18
Published
2022-05-23
Added to CISA KEV
Exploited in the wild