CVE-2019-8646
published 2019-12-18CVE-2019-8646: An out-of-bounds read was addressed with improved input validation. This issue is fixed in iOS 12.4, macOS Mojave 10.14.6, tvOS 12.4, watchOS 5.3. A remote…
PriorityP182high7.5CVSS 3.1
AVNACLPRNUINSUCHINAN
ITWEXPLOITVulnCheck KEVRansomware
Exploited in the wild
EPSS
11.03%
95.4th percentile
An out-of-bounds read was addressed with improved input validation. This issue is fixed in iOS 12.4, macOS Mojave 10.14.6, tvOS 12.4, watchOS 5.3. A remote attacker may be able to leak memory.
Affected
12 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apple | ios | — | — |
| apple | ios | >= unspecified < iOS 12.4 | iOS 12.4 |
| apple | iphone_os | < 12.4 | 12.4 |
| apple | mac_os_x | < 10.14.6 | 10.14.6 |
| apple | macos | >= unspecified < macOS Mojave 10.14.6 | macOS Mojave 10.14.6 |
| apple | macos_mojave_10.14.6_security_update_2019-004_high_sierra_security_update_2019-0 | — | — |
| apple | tvos | < 12.4 | 12.4 |
| apple | tvos | — | — |
| apple | tvos | >= unspecified < tvOS 12.4 | tvOS 12.4 |
| apple | watchos | < 5.3 | 5.3 |
| apple | watchos | — | — |
| apple | watchos | >= unspecified < watchOS 5.3 | watchOS 5.3 |
Detection & IOCsextracted from sources · hover to see the quote
- →Monitor for deserialization of the class _NSDataFileBackedFuture via NSKeyedUnarchiver, especially when secure encoding is enabled — this class bypasses secure coding restrictions and should not appear in remote iMessage payloads. ↗
- →Alert on _NSDataFileBackedFuture instances whose fileURL uses a remote (http/https) scheme but whose path component resolves to a valid local filesystem path — the class checks path existence but not URL scheme. ↗
- →Detect deserialization of INDeferredLocalizedString in iMessage/Springboard contexts — it is abused to smuggle invalid URL characters past NSURL validation to exfiltrate leaked memory bytes. ↗
- →Detect deserialization of ACZeroingString backed by a _NSDataFileBackedFuture in iMessage deserialization paths — this combination is used to trigger the out-of-bounds read. ↗
- →Monitor Springboard (SpringBoard process) for unexpected outbound HTTP connections to attacker-controlled domains, particularly those whose URL path matches a valid local filesystem path — indicative of CVE-2019-8646 memory leak exfiltration. ↗
- →Flag iMessage payloads containing serialized objects with NSData lengths significantly larger than the actual backing buffer — this is the mechanism used to create out-of-bounds read conditions. ↗
- ·The PoC exploit requires Frida to be installed on the sending device and only works on iOS 12 or later; it does not affect earlier iOS versions. ↗
- ·The attacker-controlled domain (natashenka.party in the PoC) must be replaced with an operator-controlled server for the memory-leak exfiltration stage to function; the domain itself is a PoC artifact, not a persistent threat infrastructure indicator. ↗
- ·The server-side output file length limits in myserver.py are artificially constrained in the PoC and can be removed to expose more leaked data — production exploitation may not have these limits. ↗
CVSS provenance
nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
nvdv2.05.0MEDIUMAV:N/AC:L/Au:N/C:P/I:N/A:N
vulncheck7.5HIGH
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-rwgf-fjm3-5vp2: An out-of-bounds read was addressed with improved input validation
ghsa_unreviewed·2022-05-24
CVE-2019-8646 [MEDIUM] GHSA-rwgf-fjm3-5vp2: An out-of-bounds read was addressed with improved input validation
An out-of-bounds read was addressed with improved input validation. This issue is fixed in iOS 12.4, macOS Mojave 10.14.6, tvOS 12.4, watchOS 5.3. A remote attacker may be able to leak memory.
Project0
Remote iPhone Exploitation Part 3: From Memory Corruption to JavaScript and Back -- Gaining Code Execution - Project Zero
project_zero·2020-01-01
CVE-2019-8605 Remote iPhone Exploitation Part 3: From Memory Corruption to JavaScript and Back -- Gaining Code Execution - Project Zero
Posted by Samuel Groß, Project Zero
This is the third and last post in a series about a remote, interactionless iPhone exploit over iMessage. The first blog post introduced the exploited vulnerability, and the second blog post described a way to perform a heapspray, leaking the shared cache base address.
At this point, ASLR has been broken as the shared cache’s base address is known and controlled data can be placed at a known address with the heap spray. What remains is to exploit the vulnerability one more time to gain code execution.
After a short introduction to some relevant ObjC internals, an exploit for devices without pointer authentication (PAC) will be outlined. It involves creating code pointers, so it no longer works with pointer authentication enabled. Afterwards, a diff
Project0
Remote iPhone Exploitation Part 2: Bringing Light into the Darkness -- a Remote ASLR Bypass - Project Zero
project_zero·2020-01-01
CVE-2019-8641 Remote iPhone Exploitation Part 2: Bringing Light into the Darkness -- a Remote ASLR Bypass - Project Zero
Posted by Samuel Groß, Project Zero
This post is the second in a series about a remote, interactionless iPhone exploit over iMessage.The first blog post, which introduced the exploited vulnerability, can be found here.
The initial primitive gained from the vulnerability is an absolute address dereference in which the read value is afterwards used as an ObjC object. As such, some knowledge of the target address space is required in order to exploit this vulnerability for remote code execution. This blog post describes a way to defeat ASLR remotely without any additional information disclosure vulnerabilities.
First off, the effectiveness of an old technique, heap spraying, is evaluated. Afterwards, a technique is described through which it is possible to infer the base address of the
Project0
Remote iPhone Exploitation Part 1: Poking Memory via iMessage and CVE-2019-8641 - Project Zero
project_zero·2020-01-01·CVSS 9.8
CVE-2019-8641 [CRITICAL] Remote iPhone Exploitation Part 1: Poking Memory via iMessage and CVE-2019-8641 - Project Zero
##
Posted by Samuel Groß, Project Zero
Introduction
This is the first blog post in a three-part series that will detail how a vulnerability in iMessage can be exploited remotely without any user interaction on iOS 12.4 (fixed in iOS 12.4.1 in August 2019). It is essentially a more detailed version of my 36C3 talk from December 2019.
The first part of the series provides an in-depth discussion of the vulnerability, the second part presents a technique to remotely break ASLR, and the third part explains how to gain remote code execution afterwards.
The attack presented in this series allows an attacker, who is only in possession of a user’s Apple ID (mobile phone number or email address), to remotely gain control over the user’s iOS device within a few minutes. Afterwards, an attacker
Project0
The Fully Remote Attack Surface of the iPhone - Project Zero
project_zero·2019-08-01
CVE-2019-8613 The Fully Remote Attack Surface of the iPhone - Project Zero
Posted by Natalie Silvanovich, Project Zero
While there have been several rumours and reports of fully remote vulnerabilities affecting the iPhone being used by attackers in the last couple of years, limited information is available about the technical details of these vulnerabilities, as well as the underlying attack surface they occur in. I investigated the remote, interaction-less attack surface of the iPhone, and found several serious vulnerabilities.
Vulnerabilities are considered ‘remote’ when the attacker does not require any physical or network proximity to the target to be able to use the vulnerability. Remote vulnerabilities are described as ‘fully remote’, ‘interaction-less’ or ‘zero click’ when they do not require any physical interaction from the target to be exploited, an
Project0
The Many Possibilities of CVE-2019-8646 - Project Zero
project_zero·2019-08-01·CVSS 7.5
CVE-2019-8646 [HIGH] The Many Possibilities of CVE-2019-8646 - Project Zero
Posted by Natalie Silvanovich, Project Zero
CVE-2019-8646 is a somewhat unusual vulnerability I reported in iMessage. It has a number of consequences, including information leakage and the ability to remotely read files on a device. This blog post discusses the ways that an attacker could use this bug. It is a good example of how the large number of classes available for NSKeyedArchiver deserialization can make a bug more versatile. It’s also a good example of how minor functional bugs can make a vulnerability more useful.
Please note that this blog post assumes some familiarity with NSKeyedArchiver deserialization. If you haven’t read our general post on iMessage, I’d recommend reading that first.
##
The Bug
The bug described in CVE-2019-8646 is that an unsafe class, _NSDataFileBac
VulnCheck
Apple iphone_os Out-of-bounds Read
vulncheck·2019·CVSS 7.5
CVE-2019-8646 [HIGH] Apple iphone_os Out-of-bounds Read
Apple iphone_os Out-of-bounds Read
An out-of-bounds read was addressed with improved input validation. This issue is fixed in iOS 12.4, macOS Mojave 10.14.6, tvOS 12.4, watchOS 5.3. A remote attacker may be able to leak memory.
Affected: Apple iphone_os
Required Action: Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.
Known Ransomware Campaign Use: Known
Exploitation References: https://cybersecurityworks.com/howdymanage/uploads/file/Spotlight%20Report%20-%20Index%20Update%20Q2%20-%20Q3%20-%20Final%20Version_compressed.pdf
Apple
CVE-2019-8646: iOS 12.4
vendor_apple·2019-07-22·CVSS 7.5
CVE-2019-8646 [HIGH] CVE-2019-8646: iOS 12.4
Apple Security Update: About the security content of iOS 12.4
Product: iOS
Version: 12.4
CVE: CVE-2019-8646
Component: Core Data
Impact: A remote attacker may be able to leak memory
Description: An out-of-bounds read was addressed with improved input validation.
Apple
CVE-2019-8646: tvOS 12.4
vendor_apple·2019-07-22·CVSS 7.5
CVE-2019-8646 [HIGH] CVE-2019-8646: tvOS 12.4
Apple Security Update: About the security content of tvOS 12.4
Product: tvOS
Version: 12.4
CVE: CVE-2019-8646
Component: Core Data
Impact: A remote attacker may be able to leak memory
Description: An out-of-bounds read was addressed with improved input validation.
Apple
CVE-2019-8646: watchOS 5.3
vendor_apple·2019-07-22·CVSS 7.5
CVE-2019-8646 [HIGH] CVE-2019-8646: watchOS 5.3
Apple Security Update: About the security content of watchOS 5.3
Product: watchOS
Version: 5.3
CVE: CVE-2019-8646
Component: Core Data
Impact: A remote attacker may be able to leak memory
Description: An out-of-bounds read was addressed with improved input validation.
Apple
CVE-2019-8646: macOS Mojave 10.14.6, Security Update 2019-004 High Sierra, Security Update 2019-004 Sierra
vendor_apple·2019-07-22·CVSS 7.5
CVE-2019-8646 [HIGH] CVE-2019-8646: macOS Mojave 10.14.6, Security Update 2019-004 High Sierra, Security Update 2019-004 Sierra
Apple Security Update: About the security content of macOS Mojave 10.14.6, Security Update 2019-004 High Sierra, Security Update 2019-004 Sierra
Product: macOS Mojave 10.14.6, Security Update 2019-004 High Sierra, Security Update 2019-004 Sierra
CVE: CVE-2019-8646
Component: Core Data
Impact: A remote attacker may be able to leak memory
Description: An out-of-bounds read was addressed with improved input validation.
No detection rules found.
No writeups or analysis indexed.
2019-12-18
Published
Exploited in the wild