CVE-2019-8794
published 2019-12-18CVE-2019-8794: A validation issue was addressed with improved input sanitization. This issue is fixed in iOS 13.2 and iPadOS 13.2, macOS Catalina 10.15.1, tvOS 13.2, watchOS…
PriorityP423medium5.5CVSS 3.1
AVLACLPRNUIRSUCHINAN
EPSS
0.92%
56.6th percentile
A validation issue was addressed with improved input sanitization. This issue is fixed in iOS 13.2 and iPadOS 13.2, macOS Catalina 10.15.1, tvOS 13.2, watchOS 6.1. An application may be able to read restricted memory.
Affected
13 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apple | ios | >= unspecified < iOS 13.2 and iPadOS 13.2 | iOS 13.2 and iPadOS 13.2 |
| apple | ios_13.2_and_ipados | — | — |
| apple | ipados | < 13.2 | 13.2 |
| apple | iphone_os | < 13.2 | 13.2 |
| apple | mac_os_x | < 10.15.1 | 10.15.1 |
| apple | macos | >= unspecified < macOS Catalina 10.15.1 | macOS Catalina 10.15.1 |
| apple | macos_catalina_10.15.1_security_update_2019-001_and_security_update_2019-006 | — | — |
| apple | tvos | < 13.2 | 13.2 |
| apple | tvos | — | — |
| apple | tvos | >= unspecified < tvOS 13.2 | tvOS 13.2 |
| apple | watchos | < 6.1 | 6.1 |
| apple | watchos | — | — |
| apple | watchos | >= unspecified < watchOS 6.1 | watchOS 6.1 |
CVSS provenance
nvdv3.15.5MEDIUMCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
nvdv2.04.3MEDIUMAV:N/AC:M/Au:N/C:P/I:N/A:N
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-9jj7-gc8f-m8hq: A validation issue was addressed with improved input sanitization
ghsa_unreviewed·2022-05-24
CVE-2019-8794 [MEDIUM] GHSA-9jj7-gc8f-m8hq: A validation issue was addressed with improved input sanitization
A validation issue was addressed with improved input sanitization. This issue is fixed in iOS 13.2 and iPadOS 13.2, macOS Catalina 10.15.1, tvOS 13.2, watchOS 6.1. An application may be able to read restricted memory.
Project0
A survey of recent iOS kernel exploits - Project Zero
project_zero·2020-06-01
CVE-2016-7644 A survey of recent iOS kernel exploits - Project Zero
Posted by Brandon Azad, Project Zero
I recently found myself wishing for a single online reference providing a brief summary of the high-level exploit flow of every public iOS kernel exploit in recent years; since no such document existed, I decided to create it here.
This post summarizes original iOS kernel exploits from local app context targeting iOS 10 through iOS 13, focusing on the high-level exploit flow from the initial primitive granted by the vulnerability to kernel read/write. At the end of this post, we will briefly look at iOS kernel exploit mitigations (in both hardware and software) and how they map onto the techniques used in the exploits.
This isn't your typical P0 blog post: There is no gripping zero-day exploitation, or novel exploitation research, or thrilling mal
Apple
CVE-2019-8794: watchOS 6.1
vendor_apple·2019-10-29·CVSS 5.5
CVE-2019-8794 [MEDIUM] CVE-2019-8794: watchOS 6.1
Apple Security Update: About the security content of watchOS 6.1
Product: watchOS
Version: 6.1
CVE: CVE-2019-8794
Component: Kernel
Impact: An application may be able to read restricted memory
Description: A validation issue was addressed with improved input sanitization.
Apple
CVE-2019-8794: macOS Catalina 10.15.1, Security Update 2019-001, and Security Update 2019-006
vendor_apple·2019-10-29·CVSS 5.5
CVE-2019-8794 [MEDIUM] CVE-2019-8794: macOS Catalina 10.15.1, Security Update 2019-001, and Security Update 2019-006
Apple Security Update: About the security content of macOS Catalina 10.15.1, Security Update 2019-001, and Security Update 2019-006
Product: macOS Catalina 10.15.1, Security Update 2019-001, and Security Update 2019-006
CVE: CVE-2019-8794
Component: Kernel
Impact: An application may be able to read restricted memory
Description: A validation issue was addressed with improved input sanitization.
Apple
CVE-2019-8794: iOS 13.2 and iPadOS 13.2
vendor_apple·2019-10-28·CVSS 5.5
CVE-2019-8794 [MEDIUM] CVE-2019-8794: iOS 13.2 and iPadOS 13.2
Apple Security Update: About the security content of iOS 13.2 and iPadOS 13.2
Product: iOS 13.2 and iPadOS
Version: 13.2
CVE: CVE-2019-8794
Component: Kernel
Impact: An application may be able to read restricted memory
Description: A validation issue was addressed with improved input sanitization.
Apple
CVE-2019-8794: tvOS 13.2
vendor_apple·2019-10-28·CVSS 5.5
CVE-2019-8794 [MEDIUM] CVE-2019-8794: tvOS 13.2
Apple Security Update: About the security content of tvOS 13.2
Product: tvOS
Version: 13.2
CVE: CVE-2019-8794
Component: Kernel
Impact: An application may be able to read restricted memory
Description: A validation issue was addressed with improved input sanitization.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2019-12-18
Published