CVE-2019-8672

published 2019-12-18

CVE-2019-8672: Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in iOS 12.4, macOS Mojave 10.14.6, tvOS 12.4, watchOS 5.3…

Priority P2 67 high 8.8 CVSS 3.1

AV N AC L PR N UI R S U C H I H A H

EXPLOIT

Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in iOS 12.4, macOS Mojave 10.14.6, tvOS 12.4, watchOS 5.3, Safari 12.1.2, iTunes for Windows 12.9.6, iCloud for Windows 7.13, iCloud for Windows 10.6. Processing maliciously crafted web content may lead to arbitrary code execution.

Affected

28 ranges · showing 25

Vendor	Product	Version range	Fixed in
apple	icloud	< 7.13	7.13
apple	icloud	>= 10.0 < 10.6	10.6
apple	icloud_for_windows	—	—
apple	icloud_for_windows	—	—
apple	icloud_for_windows	>= unspecified < iCloud for Windows 7.13	iCloud for Windows 7.13
apple	icloud_for_windows	>= unspecified < iCloud for Windows 10.6	iCloud for Windows 10.6
apple	ios	—	—
apple	ios	>= unspecified < iOS 12.4	iOS 12.4
apple	iphone_os	< 12.4	12.4
apple	itunes	< 12.9.6	12.9.6
apple	itunes_12.9.6_for_windows	—	—
apple	itunes_for_windows	>= unspecified < iTunes for Windows 12.9.6	iTunes for Windows 12.9.6
apple	mac_os_x	< 10.14.6	10.14.6
apple	macos	>= unspecified < macOS Mojave 10.14.6	macOS Mojave 10.14.6
apple	macos_mojave_10.14.6_security_update_2019-004_high_sierra_security_update_2019-0	—	—
apple	safari	< 12.1.2	12.1.2
apple	safari	—	—
apple	safari	>= unspecified < Safari 12.1.2	Safari 12.1.2
apple	tvos	< 12.4	12.4
apple	tvos	—	—
apple	tvos	>= unspecified < tvOS 12.4	tvOS 12.4
apple	watchos	< 5.3	5.3
apple	watchos	—	—
apple	watchos	>= unspecified < watchOS 5.3	watchOS 5.3
debian	webkit2gtk	< webkit2gtk 2.24.2-1 (bookworm)	webkit2gtk 2.24.2-1 (bookworm)

Detection & IOCs extracted from sources · hover to see the quote

command --useConcurrentJIT=false --thresholdForJITAfterWarmUp=10↗

• → The vulnerability is a JSValue Use-After-Free in JavaScriptCore ValueProfiles. Look for crashes or anomalous behavior in JSC when a CodeBlock's ValueProfile retains a dangling pointer to a freed JSCell (e.g., Uint32Array) after an eden GC cycle without unconditional finalization. ↗
• → Trigger condition involves a JS builtin (TypedArray.values) being baseline-JIT-compiled, storing a newly allocated Uint32Array into a ValueProfile bucket, followed by a stack overflow exception — leaving the array unreferenced and collectible by the next eden GC while the CodeBlock is not re-finalized. ↗
• → Monitor for exploitation of WebKit/JavaScriptCore via maliciously crafted web content leading to arbitrary code execution on unpatched Apple platforms (iOS < 12.4, macOS < 10.14.6, tvOS < 12.4, watchOS < 5.3, Safari < 12.1.2, iTunes for Windows < 12.9.6, iCloud for Windows < 7.13/10.6). ↗

• · The PoC requires JSC runtime flags to reproduce; concurrent JIT must be disabled and the JIT warm-up threshold lowered, which is non-default and may not reflect real-world exploit delivery conditions. ↗
• · The infinite recursion / stack overflow in the PoC may be specifically required to force the right sequence of GC invocations and is not necessarily representative of all exploit variants. ↗
• · Red Hat packages webkitgtk (RHEL 6) and webkitgtk3 (RHEL 7) are affected but will not be fixed (out of support scope / will not fix), meaning deployments on these platforms remain permanently vulnerable. ↗

CVSS provenance

nvd v3.1 8.8 HIGH CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

nvd v2.0 9.3 CRITICAL AV:N/AC:M/Au:N/C:C/I:C/A:C

osv 8.8 HIGH

vendor_debian 8.8 HIGH

vendor_redhat 8.8 HIGH

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-787