CVE-2019-8641
published 2019-12-18CVE-2019-8641: An out-of-bounds read was addressed with improved input validation.
PriorityP265critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
EXPLOIT
EPSS
17.00%
96.7th percentile
An out-of-bounds read was addressed with improved input validation.
Affected
13 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apple | ios | — | — |
| apple | ios | — | — |
| apple | ios | >= unspecified < iOS 12.4.2 | iOS 12.4.2 |
| apple | ios | >= unspecified < iOS 13 | iOS 13 |
| apple | iphone_os | < 12.4 | 12.4 |
| apple | mac_os_x | < 10.14.6 | 10.14.6 |
| apple | macos | >= unspecified < macOS Mojave 10.14.6 Supplemental Update 2 | macOS Mojave 10.14.6 Supplemental Update 2 |
| apple | macos_mojave_10.14.6_supplemental_update_2_security_update_2019-005_high_sierra | — | — |
| apple | tvos | < 12.4 | 12.4 |
| apple | watchos | < 5.3 | 5.3 |
| apple | watchos | — | — |
| apple | watchos | >= unspecified < watchOS 6 | watchOS 6 |
| apple | watchos | >= unspecified < watchOS 5.3.2 | watchOS 5.3.2 |
Detection & IOCsextracted from sources · hover to see the quote
- →Monitor for deserialization of NSSharedKeyDictionary and NSSharedKeySet via NSUnarchiver/NSKeyedUnarchiver in iMessage processing; a crafted payload exploiting this bug will trigger an out-of-bounds read crash in -[NSSharedKeySet indexForKey:] within CoreFoundation. ↗
- →Crash signature to look for: EXC_BAD_ACCESS (code=1) at address 0x414141410 inside CoreFoundation -[NSSharedKeySet indexForKey:] + 566, indicating attacker-controlled heap spray address dereference. ↗
- →Detect iMessage-delivered payloads that encode NSSharedKeyDictionary objects with a circular _subKeySet reference (SharedKeySet1 -> SharedKeySet2 -> SharedKeySet1); this self-referential structure is the exploit primitive. ↗
- →Flag NSSharedKeySet objects decoded with _numKeys set to 0xffffffff (UINT_MAX) while _keys is still null/uninitialized — this is the precondition for the out-of-bounds read primitive. ↗
- →Alert on Springboard crashes involving out-of-bounds reads in Foundation/CoreFoundation triggered by incoming iMessage data, particularly involving NSSharedKeyDictionary value array accesses beyond allocated heap memory. ↗
- ·The exploit requires NSSharedKeyDictionary to be an allowed deserialization class via NSUnarchiver; if the attack surface is removed (e.g., by disallowing NSSharedKeyDictionary in the unarchiver allowlist), the vulnerability is not reachable. ↗
- ·The PoC does not crash reliably in Springboard; exploitability in production iMessage environments may require additional heap spray primitives to achieve reliable code execution. ↗
- ·Combined with a heap spray, the bug could be remotely exploitable; detection should account for heap spray activity alongside the deserialization crash. ↗
- ·NSSharedKeyDictionary instances can be correctly encoded and decoded with the standard NSDictionary initWithCoder, meaning legitimate traffic will not use the NSSharedKeyDictionary-specific encoding path; any such encoded object in iMessage is anomalous. ↗
CVSS provenance
nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv2.07.5HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Apple
CVE-2019-8641: macOS Mojave 10.14.6 Supplemental Update 2, Security Update 2019-005 High Sierra, and Security Update 2019-005 Sierra
vendor_apple·2019-09-26·CVSS 9.8
CVE-2019-8641 [CRITICAL] CVE-2019-8641: macOS Mojave 10.14.6 Supplemental Update 2, Security Update 2019-005 High Sierra, and Security Update 2019-005 Sierra
Apple Security Update: About the security content of macOS Mojave 10.14.6 Supplemental Update 2, Security Update 2019-005 High Sierra, and Security Update 2019-005 Sierra
Product: macOS Mojave 10.14.6 Supplemental Update 2, Security Update 2019-005 High Sierra, and Security Update 2019-005 Sierra
CVE: CVE-2019-8641
Component: Foundation
Impact: An application may be able to read restricted memory
Description: A validation issue was addressed with improved input sanitization.
Apple
CVE-2019-8641: watchOS 5.3.2
vendor_apple·2019-09-26·CVSS 9.8
CVE-2019-8641 [CRITICAL] CVE-2019-8641: watchOS 5.3.2
Apple Security Update: About the security content of watchOS 5.3.2
Product: watchOS
Version: 5.3.2
CVE: CVE-2019-8641
Component: Foundation
Impact: An application may be able to read restricted memory
Description: A validation issue was addressed with improved input sanitization.
Apple
CVE-2019-8641: iOS 12.4.2
vendor_apple·2019-09-26·CVSS 9.8
CVE-2019-8641 [CRITICAL] CVE-2019-8641: iOS 12.4.2
Apple Security Update: About the security content of iOS 12.4.2
Product: iOS
Version: 12.4.2
CVE: CVE-2019-8641
Component: Foundation
Impact: An application may be able to read restricted memory
Description: A validation issue was addressed with improved input sanitization.
Apple
CVE-2019-8641: iOS 13
vendor_apple·2019-09-19·CVSS 9.8
CVE-2019-8641 [CRITICAL] CVE-2019-8641: iOS 13
Apple Security Update: About the security content of iOS 13
Product: iOS
Version: 13
CVE: CVE-2019-8641
Component: Foundation
Impact: A remote attacker may be able to cause unexpected application termination or arbitrary code execution
Description: An out-of-bounds read was addressed with improved input validation.
GHSA
GHSA-27cj-jh44-8xw6: An out-of-bounds read was addressed with improved input validation
ghsa_unreviewed·2022-05-24
CVE-2019-8641 [HIGH] GHSA-27cj-jh44-8xw6: An out-of-bounds read was addressed with improved input validation
An out-of-bounds read was addressed with improved input validation. This issue is fixed in iOS 12.4, macOS Mojave 10.14.6, tvOS 12.4, watchOS 5.3. A remote attacker may be able to cause unexpected application termination or arbitrary code execution.
Project0
MMS Exploit Part 3: Constructing the Memory Corruption Primitives - Project Zero
project_zero·2020-07-01
CVE-2019-8641 MMS Exploit Part 3: Constructing the Memory Corruption Primitives - Project Zero
Posted by Mateusz Jurczyk, Project Zero
This post is the third of a multi-part series capturing my journey from discovering a vulnerable little-known Samsung image codec, to completing a remote zero-click MMS attack that worked on the latest Samsung flagship devices. New posts will be published as they are completed and will be linked here when complete.
-
MMS Exploit Part 1: Introduction to the Samsung Qmage Codec and Remote Attack Surface
-
MMS Exploit Part 2: Effective Fuzzing of the Qmage Codec
-
[this post]
-
MMS Exploit Part 4: MMS Primer, Completing the ASLR Oracle
-
MMS Exploit Part 5: Defeating Android ASLR, Getting RCE
##
Introduction
In Part 2, I discussed how I managed to fuzz-test the Qmage codec on Google infrastructure at the turn of 2019/2020. It led to the d
Project0
Remote iPhone Exploitation Part 3: From Memory Corruption to JavaScript and Back -- Gaining Code Execution - Project Zero
project_zero·2020-01-01
CVE-2019-8605 Remote iPhone Exploitation Part 3: From Memory Corruption to JavaScript and Back -- Gaining Code Execution - Project Zero
Posted by Samuel Groß, Project Zero
This is the third and last post in a series about a remote, interactionless iPhone exploit over iMessage. The first blog post introduced the exploited vulnerability, and the second blog post described a way to perform a heapspray, leaking the shared cache base address.
At this point, ASLR has been broken as the shared cache’s base address is known and controlled data can be placed at a known address with the heap spray. What remains is to exploit the vulnerability one more time to gain code execution.
After a short introduction to some relevant ObjC internals, an exploit for devices without pointer authentication (PAC) will be outlined. It involves creating code pointers, so it no longer works with pointer authentication enabled. Afterwards, a diff
Project0
Remote iPhone Exploitation Part 2: Bringing Light into the Darkness -- a Remote ASLR Bypass - Project Zero
project_zero·2020-01-01
CVE-2019-8641 Remote iPhone Exploitation Part 2: Bringing Light into the Darkness -- a Remote ASLR Bypass - Project Zero
Posted by Samuel Groß, Project Zero
This post is the second in a series about a remote, interactionless iPhone exploit over iMessage.The first blog post, which introduced the exploited vulnerability, can be found here.
The initial primitive gained from the vulnerability is an absolute address dereference in which the read value is afterwards used as an ObjC object. As such, some knowledge of the target address space is required in order to exploit this vulnerability for remote code execution. This blog post describes a way to defeat ASLR remotely without any additional information disclosure vulnerabilities.
First off, the effectiveness of an old technique, heap spraying, is evaluated. Afterwards, a technique is described through which it is possible to infer the base address of the
Project0
Remote iPhone Exploitation Part 1: Poking Memory via iMessage and CVE-2019-8641 - Project Zero
project_zero·2020-01-01·CVSS 9.8
CVE-2019-8641 [CRITICAL] Remote iPhone Exploitation Part 1: Poking Memory via iMessage and CVE-2019-8641 - Project Zero
##
Posted by Samuel Groß, Project Zero
Introduction
This is the first blog post in a three-part series that will detail how a vulnerability in iMessage can be exploited remotely without any user interaction on iOS 12.4 (fixed in iOS 12.4.1 in August 2019). It is essentially a more detailed version of my 36C3 talk from December 2019.
The first part of the series provides an in-depth discussion of the vulnerability, the second part presents a technique to remotely break ASLR, and the third part explains how to gain remote code execution afterwards.
The attack presented in this series allows an attacker, who is only in possession of a user’s Apple ID (mobile phone number or email address), to remotely gain control over the user’s iOS device within a few minutes. Afterwards, an attacker
Project0
The Fully Remote Attack Surface of the iPhone - Project Zero
project_zero·2019-08-01
CVE-2019-8613 The Fully Remote Attack Surface of the iPhone - Project Zero
Posted by Natalie Silvanovich, Project Zero
While there have been several rumours and reports of fully remote vulnerabilities affecting the iPhone being used by attackers in the last couple of years, limited information is available about the technical details of these vulnerabilities, as well as the underlying attack surface they occur in. I investigated the remote, interaction-less attack surface of the iPhone, and found several serious vulnerabilities.
Vulnerabilities are considered ‘remote’ when the attacker does not require any physical or network proximity to the target to be able to use the vulnerability. Remote vulnerabilities are described as ‘fully remote’, ‘interaction-less’ or ‘zero click’ when they do not require any physical interaction from the target to be exploited, an
No detection rules found.
Exploit-DB
iMessage - Decoding NSSharedKeyDictionary can read ObjC Object at Attacker Controlled Address
exploitdb·2019-11-11
CVE-2019-8662 iMessage - Decoding NSSharedKeyDictionary can read ObjC Object at Attacker Controlled Address
iMessage - Decoding NSSharedKeyDictionary can read ObjC Object at Attacker Controlled Address
---
During processing of incoming iMessages, attacker controlled data is deserialized using the
NSUnarchiver API. One of the classes that is allowed to be decoded from the incoming data is
NSDictionary. However, due to the logic of NSUnarchiver, all subclasses of NSDictionary that also
implement secure coding can then be deserialized as well. NSSharedKeyDictionary is an example of
such a subclass. A NSSharedKeyDictionary is a dictionary for which, for performance reasons, the
keys are predefined using a NSSharedKeySet.
A NSSharedKeyDictionary is essentially a linear array of values and a pointer to its
NSSharedKeySet. An NSSharedKeySet on the other hand looks roughly like this (with some fields
Exploit-DB
iMessage - Decoding NSSharedKeyDictionary Can Read Object Out of Bounds
exploitdb·2019-09-24
CVE-2019-8641 iMessage - Decoding NSSharedKeyDictionary Can Read Object Out of Bounds
iMessage - Decoding NSSharedKeyDictionary Can Read Object Out of Bounds
---
When an NSKeyedUnarchiver decodes an object, it first allocates the object using allocWithZone, and then puts the object into a dictionary for temporary objects. It then calls the appropriate initWithCoder: on the allocated object. If initWithCoder: or any method it calls decodes the same object, its gets back a reference to the original object in the temporary object dictionary. For many classes, this is a placeholder object that will throw an "uninitialized" exception when accessed, but for some classes, this is the object that will eventually be returned by initWithCoder:. This means that when an initWithCoder: method decodes an object that has a reference to itself in it, the object might not be fully initial
No writeups or analysis indexed.
https://support.apple.com/HT210588https://support.apple.com/HT210589https://support.apple.com/HT210590https://support.apple.com/HT210606https://support.apple.com/HT210607https://support.apple.com/HT210588https://support.apple.com/HT210589https://support.apple.com/HT210590https://support.apple.com/HT210606https://support.apple.com/HT210607
2019-12-18
Published