Public exploit available
Public proof-of-concept or exploit code exists (ExploitDB / Metasploit / Nuclei).

CVE-2019-8591 — Type Confusion in Apple Macos

CWE-843 — Type Confusion8 documents5 sources
Severity
7.1HIGHNVD
EPSS
8.4%
top 7.66%
CISA KEV
Not in KEV
Exploit
PoC available
Public exploit / PoC exists
Affected products
6
Apple IOSApple MacosApple Tvos+3 more
Timeline
PublishedDec 18
Latest updateMay 24

Description

A type confusion issue was addressed with improved memory handling. This issue is fixed in iOS 12.3, macOS Mojave 10.14.5, tvOS 12.3, watchOS 5.2.1. An application may be able to cause unexpected system termination or write kernel memory.

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:HExploitability: 1.8 | Impact: 5.2

Affected Packages8 packages

▶CVEListV5apple/tvosunspecified — tvOS 12.3
▶NVDapple/tvos< 12.3
▶CVEListV5apple/macosunspecified — macOS Mojave 10.14.5
▶CVEListV5apple/watchosunspecified — watchOS 5.2.1
▶NVDapple/watchos< 5.2.1

🔴Vulnerability Details

2
GHSA
GHSA-3fv9-r273-qjc2: A type confusion issue was addressed with improved memory handling↗2022-05-24
▶
CVEList
CVE-2019-8591: A type confusion issue was addressed with improved memory handling↗2019-12-18
▶

💥Exploits & PoCs

1
Exploit-DB
Apple macOS < 10.14.5 / iOS < 12.3 XNU - Wild-read due to bad cast in stf_ioctl↗2019-05-21
▶

📋Vendor Advisories

4
Apple
CVE-2019-8591: macOS Mojave 10.14.5, Security Update 2019-003 High Sierra, Security Update 2019-003 Sierra↗2019-05-13
▶
Apple
CVE-2019-8591: watchOS 5.2.1↗2019-05-13
▶
Apple
CVE-2019-8591: tvOS 12.3↗2019-05-13
▶
Apple
CVE-2019-8591: iOS 12.3↗2019-05-13
▶
CVE-2019-8591 — Type Confusion in Apple Macos | cvebase