CVE-2019-8623

published 2019-12-18

CVE-2019-8623: Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in iOS 12.3, macOS Mojave 10.14.5, tvOS 12.3, watchOS…

Priority P2 65 high 8.8 CVSS 3.1

AV N AC L PR N UI R S U C H I H A H

EXPLOIT

Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in iOS 12.3, macOS Mojave 10.14.5, tvOS 12.3, watchOS 5.2.1, Safari 12.1.1, iTunes for Windows 12.9.5, iCloud for Windows 7.12. Processing maliciously crafted web content may lead to arbitrary code execution.

Affected

24 ranges

Vendor	Product	Version range	Fixed in
apple	icloud	< 7.12	7.12
apple	icloud	>= 10.0 < 10.4	10.4
apple	icloud_for_windows	—	—
apple	icloud_for_windows	—	—
apple	icloud_for_windows	>= unspecified < iCloud for Windows 7.12	iCloud for Windows 7.12
apple	ios	—	—
apple	ios	>= unspecified < iOS 12.3	iOS 12.3
apple	iphone_os	< 12.3	12.3
apple	itunes	< 12.9.5	12.9.5
apple	itunes_for_windows	—	—
apple	itunes_for_windows	>= unspecified < iTunes for Windows 12.9.5	iTunes for Windows 12.9.5
apple	mac_os_x	< 10.14.5	10.14.5
apple	macos	>= unspecified < macOS Mojave 10.14.5	macOS Mojave 10.14.5
apple	macos_mojave_10.14.5_security_update_2019-003_high_sierra_security_update_2019-0	—	—
apple	safari	< 12.1.1	12.1.1
apple	safari	—	—
apple	safari	>= unspecified < Safari 12.1.1	Safari 12.1.1
apple	tvos	< 12.3	12.3
apple	tvos	—	—
apple	tvos	>= unspecified < tvOS 12.3	tvOS 12.3
apple	watchos	< 5.2.1	5.2.1
apple	watchos	—	—
apple	watchos	>= unspecified < watchOS 5.2.1	watchOS 5.2.1
debian	webkit2gtk	< webkit2gtk 2.24.1-1 (bookworm)	webkit2gtk 2.24.1-1 (bookworm)

Detection & IOCs extracted from sources · hover to see the quote

command --useConcurrentJIT=false↗

path /System/Library/Frameworks/JavaScriptCore.framework/Resources/jsc↗

• → Crash in JavaScriptCore JIT-compiled code with EXC_BAD_ACCESS (EXC_I386_GPFLT) where RAX contains a value matching the pattern 0x0001XXXXXXXXXXXX due to NaN boxing — indicative of uninitialized stack slot read triggered by LICM miscompilation. ↗
• → RAX value of 0x0001414141414141 in a JavaScriptCore crash context indicates a sprayed/controlled value was loaded from an uninitialized stack slot — a sign of CVE-2019-8623 exploitation attempt. ↗
• → Exploit PoC uses a stack spray pattern combined with a miscompiled varargs/spread call inside a loop to corrupt memory; monitor for JavaScriptCore DFG JIT crashes involving GetStack/LoadVarargs IR operations. ↗
• → The vulnerability is triggered via maliciously crafted web content processed by WebKit/JavaScriptCore; monitor WebKit-based browsers and apps (Safari, iTunes, iCloud) for unexpected JIT crashes or EXC_BAD_ACCESS signals originating from JavaScriptCore. ↗

• · The PoC crash is more reliable with concurrent JIT disabled; with default settings (--useConcurrentJIT=true) the crash is less consistent, meaning detection based solely on crash telemetry may miss exploitation attempts under default JIT configuration. ↗
• · The root cause is a logical flaw in DFGLICMPhase.cpp where LICM ignores memory writes in blocks CFA marks as dead code, then hoists memory reads from those same blocks into live code — meaning the corruption is compiler-driven and may manifest differently across JIT compilation thresholds. ↗
• · The uninitialized stack slot read may result in varied memory corruption outcomes depending on stack contents at runtime; the PoC uses 0x414141414141 as a canary value but real exploitation would use a valid pointer value instead. ↗

CVSS provenance

nvd v3.1 8.8 HIGH CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

nvd v2.0 6.8 MEDIUM AV:N/AC:M/Au:N/C:P/I:P/A:P

osv 8.8 HIGH

vendor_debian 8.8 HIGH

vendor_redhat 8.8 HIGH

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-787