CVE-2019-8662
published 2019-12-18CVE-2019-8662: This issue was addressed with improved checks. This issue is fixed in iOS 12.4, macOS Mojave 10.14.6, tvOS 12.4, watchOS 5.3. An attacker may be able to…
PriorityP262critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
EXPLOIT
EPSS
9.78%
95.0th percentile
This issue was addressed with improved checks. This issue is fixed in iOS 12.4, macOS Mojave 10.14.6, tvOS 12.4, watchOS 5.3. An attacker may be able to trigger a use-after-free in an application deserializing an untrusted NSDictionary.
Affected
12 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apple | ios | — | — |
| apple | ios | >= unspecified < iOS 12.4 | iOS 12.4 |
| apple | iphone_os | < 12.4 | 12.4 |
| apple | mac_os_x | < 10.14.6 | 10.14.6 |
| apple | macos | >= unspecified < macOS Mojave 10.14.6 | macOS Mojave 10.14.6 |
| apple | macos_mojave_10.14.6_security_update_2019-004_high_sierra_security_update_2019-0 | — | — |
| apple | tvos | < 12.4 | 12.4 |
| apple | tvos | — | — |
| apple | tvos | >= unspecified < tvOS 12.4 | tvOS 12.4 |
| apple | watchos | < 5.3 | 5.3 |
| apple | watchos | — | — |
| apple | watchos | >= unspecified < watchOS 5.3 | watchOS 5.3 |
Detection & IOCsextracted from sources · hover to see the quote
- →Monitor for deserialization of NSDictionary subclasses (specifically OITSUIntDictionary and NSSharedKeyDictionary) via NSKeyedUnarchiver/NSUnarchiver in processes that handle untrusted data, particularly iMessage parsing (Springboard process). The OfficeImport framework being loaded in Springboard makes this remotely triggerable via iMessage without user interaction. ↗
- →Detect crashes or EXC_BAD_ACCESS at address 0x414141410 in CoreFoundation's -[NSSharedKeySet indexForKey:] as an indicator of exploitation attempt via heap spray against CVE-2019-8662. ↗
- →Look for crafted NSDictionary archives where the class name in the serialized plist has been replaced from a parent class (e.g. NSDictionary) to a child class (e.g. OITSUIntDictionary or NSSharedKeyDictionary). This is the exploitation technique: archive a valid NSDictionary, then replace the class name in the XML plist. ↗
- →Flag iMessage payloads containing NSSharedKeyDictionary or NSSharedKeySet class references with attacker-controlled _rankTable, _numKeys (e.g. 0xffffffff), _factor, and circular _subKeySet references as indicators of exploitation. ↗
- →Monitor for loading of OfficeImport framework within Springboard or other processes that deserialize untrusted NSDictionary objects, as this indicates the attack surface is present. ↗
- ·NSKeyedUnarchiver's class whitelist enforcement is insufficient: child classes of whitelisted classes (e.g. NSDictionary subclasses) are also deserialized if they implement supportsSecureCoding, bypassing the intended security boundary. Secure coding enforcement alone does NOT prevent exploitation. ↗
- ·The vulnerability affects the Quick Look component across iOS 12.4 (and prior), macOS Mojave 10.14.6 (and prior), tvOS 12.4 (and prior), and watchOS 5.3 (and prior). Patches are available in those respective versions. ↗
CVSS provenance
nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv2.07.5HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Apple
CVE-2019-8662: watchOS 5.3
vendor_apple·2019-07-22·CVSS 9.8
CVE-2019-8662 [CRITICAL] CVE-2019-8662: watchOS 5.3
Apple Security Update: About the security content of watchOS 5.3
Product: watchOS
Version: 5.3
CVE: CVE-2019-8662
Component: Quick Look
Impact: An attacker may be able to trigger a use-after-free in an application deserializing an untrusted NSDictionary
Description: This issue was addressed with improved checks.
Apple
CVE-2019-8662: macOS Mojave 10.14.6, Security Update 2019-004 High Sierra, Security Update 2019-004 Sierra
vendor_apple·2019-07-22·CVSS 9.8
CVE-2019-8662 [CRITICAL] CVE-2019-8662: macOS Mojave 10.14.6, Security Update 2019-004 High Sierra, Security Update 2019-004 Sierra
Apple Security Update: About the security content of macOS Mojave 10.14.6, Security Update 2019-004 High Sierra, Security Update 2019-004 Sierra
Product: macOS Mojave 10.14.6, Security Update 2019-004 High Sierra, Security Update 2019-004 Sierra
CVE: CVE-2019-8662
Component: Quick Look
Impact: An attacker may be able to trigger a use-after-free in an application deserializing an untrusted NSDictionary
Description: This issue was addressed with improved checks.
Apple
CVE-2019-8662: tvOS 12.4
vendor_apple·2019-07-22·CVSS 9.8
CVE-2019-8662 [CRITICAL] CVE-2019-8662: tvOS 12.4
Apple Security Update: About the security content of tvOS 12.4
Product: tvOS
Version: 12.4
CVE: CVE-2019-8662
Component: Quick Look
Impact: An attacker may be able to trigger a use-after-free in an application deserializing an untrusted NSDictionary
Description: This issue was addressed with improved checks.
Apple
CVE-2019-8662: iOS 12.4
vendor_apple·2019-07-22·CVSS 9.8
CVE-2019-8662 [CRITICAL] CVE-2019-8662: iOS 12.4
Apple Security Update: About the security content of iOS 12.4
Product: iOS
Version: 12.4
CVE: CVE-2019-8662
Component: Quick Look
Impact: An attacker may be able to trigger a use-after-free in an application deserializing an untrusted NSDictionary
Description: This issue was addressed with improved checks.
GHSA
GHSA-v448-6mjx-mr34: This issue was addressed with improved checks
ghsa_unreviewed·2022-05-24
CVE-2019-8662 [HIGH] GHSA-v448-6mjx-mr34: This issue was addressed with improved checks
This issue was addressed with improved checks. This issue is fixed in iOS 12.4, macOS Mojave 10.14.6, tvOS 12.4, watchOS 5.3. An attacker may be able to trigger a use-after-free in an application deserializing an untrusted NSDictionary.
Project0
Remote iPhone Exploitation Part 2: Bringing Light into the Darkness -- a Remote ASLR Bypass - Project Zero
project_zero·2020-01-01
CVE-2019-8641 Remote iPhone Exploitation Part 2: Bringing Light into the Darkness -- a Remote ASLR Bypass - Project Zero
Posted by Samuel Groß, Project Zero
This post is the second in a series about a remote, interactionless iPhone exploit over iMessage.The first blog post, which introduced the exploited vulnerability, can be found here.
The initial primitive gained from the vulnerability is an absolute address dereference in which the read value is afterwards used as an ObjC object. As such, some knowledge of the target address space is required in order to exploit this vulnerability for remote code execution. This blog post describes a way to defeat ASLR remotely without any additional information disclosure vulnerabilities.
First off, the effectiveness of an old technique, heap spraying, is evaluated. Afterwards, a technique is described through which it is possible to infer the base address of the
Project0
The Fully Remote Attack Surface of the iPhone - Project Zero
project_zero·2019-08-01
CVE-2019-8613 The Fully Remote Attack Surface of the iPhone - Project Zero
Posted by Natalie Silvanovich, Project Zero
While there have been several rumours and reports of fully remote vulnerabilities affecting the iPhone being used by attackers in the last couple of years, limited information is available about the technical details of these vulnerabilities, as well as the underlying attack surface they occur in. I investigated the remote, interaction-less attack surface of the iPhone, and found several serious vulnerabilities.
Vulnerabilities are considered ‘remote’ when the attacker does not require any physical or network proximity to the target to be able to use the vulnerability. Remote vulnerabilities are described as ‘fully remote’, ‘interaction-less’ or ‘zero click’ when they do not require any physical interaction from the target to be exploited, an
No detection rules found.
Exploit-DB
iMessage - Decoding NSSharedKeyDictionary can read ObjC Object at Attacker Controlled Address
exploitdb·2019-11-11
CVE-2019-8662 iMessage - Decoding NSSharedKeyDictionary can read ObjC Object at Attacker Controlled Address
iMessage - Decoding NSSharedKeyDictionary can read ObjC Object at Attacker Controlled Address
---
During processing of incoming iMessages, attacker controlled data is deserialized using the
NSUnarchiver API. One of the classes that is allowed to be decoded from the incoming data is
NSDictionary. However, due to the logic of NSUnarchiver, all subclasses of NSDictionary that also
implement secure coding can then be deserialized as well. NSSharedKeyDictionary is an example of
such a subclass. A NSSharedKeyDictionary is a dictionary for which, for performance reasons, the
keys are predefined using a NSSharedKeySet.
A NSSharedKeyDictionary is essentially a linear array of values and a pointer to its
NSSharedKeySet. An NSSharedKeySet on the other hand looks roughly like this (with some fields
Exploit-DB
macOS / iOS NSKeyedUnarchiver - Use-After-Free of ObjC Objects when Unarchiving OITSUIntDictionary Instances
exploitdb·2019-07-30
CVE-2019-8662 macOS / iOS NSKeyedUnarchiver - Use-After-Free of ObjC Objects when Unarchiving OITSUIntDictionary Instances
macOS / iOS NSKeyedUnarchiver - Use-After-Free of ObjC Objects when Unarchiving OITSUIntDictionary Instances
---
When deserializing NSObjects with the NSArchiver API [1], one can supply a whitelist of classes that are allowed to be unarchived. In that case, any object in the archive whose class is not whitelisted will not be deserialized. Doing so will also cause the NSKeyedUnarchiver to "requireSecureCoding", ensuring that the archived classes conform to the NSSecureCoding protocol before deserializing them. With that, deserialization of untrusted archives is expected to now be possible in a secure manner. However, a child class of a class in the whitelist will also be deserialized by NSKeyedUnarchiver if one of the following is true (see -[NSCoder _validateAllowedClass:forKey:allowingI
No writeups or analysis indexed.
2019-12-18
Published