CVE-2019-8647
published 2019-12-18CVE-2019-8647: A use after free issue was addressed with improved memory management. This issue is fixed in iOS 12.4, tvOS 12.4, watchOS 5.3. A remote attacker may be able to…
PriorityP269critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
EXPLOIT
EPSS
13.45%
96.0th percentile
A use after free issue was addressed with improved memory management. This issue is fixed in iOS 12.4, tvOS 12.4, watchOS 5.3. A remote attacker may be able to cause arbitrary code execution.
Affected
9 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apple | ios | — | — |
| apple | ios | >= unspecified < iOS 12.4 | iOS 12.4 |
| apple | iphone_os | < 12.4 | 12.4 |
| apple | tvos | < 12.4 | 12.4 |
| apple | tvos | — | — |
| apple | tvos | >= unspecified < tvOS 12.4 | tvOS 12.4 |
| apple | watchos | < 5.3 | 5.3 |
| apple | watchos | — | — |
| apple | watchos | >= unspecified < watchOS 5.3 | watchOS 5.3 |
Detection & IOCsextracted from sources · hover to see the quote
- →The vulnerability is reachable via iMessage with zero user interaction — monitor for Springboard crashes (SpringBoard process termination) on iOS devices, which may indicate exploitation attempts. ↗
- →Exploitation involves deserialization of a _PFArray object (NSArray subclass) via NSKeyedUnarchiver through iMessage. Inspect iMessage payloads for NSKeyedUnarchiver archives containing _PFArray class references. ↗
- →The exploit delivery mechanism uses a Python script (sendMessage.py) and a JavaScript injection script (injectMessage.js) alongside Frida to send a crafted iMessage payload. Presence of these files together on a host may indicate an attacker staging environment. ↗
- →The affected component is Core Data on iOS, tvOS, and watchOS. Focus detection on use-after-free crashes or memory corruption signals originating from the Core Data framework in crash logs. ↗
- ·The exploit requires the attacker to know the target's phone number or iMessage-registered email address to deliver the malicious payload. ↗
- ·The use-after-free is triggered because _PFArray does not retain references to deserialized objects; the crash/exploitation occurs upon release of the NSKeyedUnarchiver, not at deserialization time itself. ↗
CVSS provenance
nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv2.07.5HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Apple
CVE-2019-8647: iOS 12.4
vendor_apple·2019-07-22·CVSS 9.8
CVE-2019-8647 [CRITICAL] CVE-2019-8647: iOS 12.4
Apple Security Update: About the security content of iOS 12.4
Product: iOS
Version: 12.4
CVE: CVE-2019-8647
Component: Core Data
Impact: A remote attacker may be able to cause arbitrary code execution
Description: A use after free issue was addressed with improved memory management.
Apple
CVE-2019-8647: tvOS 12.4
vendor_apple·2019-07-22·CVSS 9.8
CVE-2019-8647 [CRITICAL] CVE-2019-8647: tvOS 12.4
Apple Security Update: About the security content of tvOS 12.4
Product: tvOS
Version: 12.4
CVE: CVE-2019-8647
Component: Core Data
Impact: A remote attacker may be able to cause arbitrary code execution
Description: A use after free issue was addressed with improved memory management.
Apple
CVE-2019-8647: watchOS 5.3
vendor_apple·2019-07-22·CVSS 9.8
CVE-2019-8647 [CRITICAL] CVE-2019-8647: watchOS 5.3
Apple Security Update: About the security content of watchOS 5.3
Product: watchOS
Version: 5.3
CVE: CVE-2019-8647
Component: Core Data
Impact: A remote attacker may be able to cause arbitrary code execution
Description: A use after free issue was addressed with improved memory management.
GHSA
GHSA-fmgq-m9qq-mj46: A use after free issue was addressed with improved memory management
ghsa_unreviewed·2022-05-24
CVE-2019-8647 [HIGH] GHSA-fmgq-m9qq-mj46: A use after free issue was addressed with improved memory management
A use after free issue was addressed with improved memory management. This issue is fixed in iOS 12.4, tvOS 12.4, watchOS 5.3. A remote attacker may be able to cause arbitrary code execution.
Project0
Remote iPhone Exploitation Part 2: Bringing Light into the Darkness -- a Remote ASLR Bypass - Project Zero
project_zero·2020-01-01
CVE-2019-8641 Remote iPhone Exploitation Part 2: Bringing Light into the Darkness -- a Remote ASLR Bypass - Project Zero
Posted by Samuel Groß, Project Zero
This post is the second in a series about a remote, interactionless iPhone exploit over iMessage.The first blog post, which introduced the exploited vulnerability, can be found here.
The initial primitive gained from the vulnerability is an absolute address dereference in which the read value is afterwards used as an ObjC object. As such, some knowledge of the target address space is required in order to exploit this vulnerability for remote code execution. This blog post describes a way to defeat ASLR remotely without any additional information disclosure vulnerabilities.
First off, the effectiveness of an old technique, heap spraying, is evaluated. Afterwards, a technique is described through which it is possible to infer the base address of the
Project0
The Fully Remote Attack Surface of the iPhone - Project Zero
project_zero·2019-08-01
CVE-2019-8613 The Fully Remote Attack Surface of the iPhone - Project Zero
Posted by Natalie Silvanovich, Project Zero
While there have been several rumours and reports of fully remote vulnerabilities affecting the iPhone being used by attackers in the last couple of years, limited information is available about the technical details of these vulnerabilities, as well as the underlying attack surface they occur in. I investigated the remote, interaction-less attack surface of the iPhone, and found several serious vulnerabilities.
Vulnerabilities are considered ‘remote’ when the attacker does not require any physical or network proximity to the target to be able to use the vulnerability. Remote vulnerabilities are described as ‘fully remote’, ‘interaction-less’ or ‘zero click’ when they do not require any physical interaction from the target to be exploited, an
No detection rules found.
No writeups or analysis indexed.
2019-12-18
Published