CVE-2020-3837
published 2020-02-27CVE-2020-3837: A memory corruption issue was addressed with improved memory handling. This issue is fixed in iOS 13.3.1 and iPadOS 13.3.1, macOS Catalina 10.15.3, tvOS…
PriorityP183high7.8CVSS 3.1
AVLACLPRNUIRSUCHIHAH
KEVITWEXPLOIT
CISA Known Exploited Vulnerabilitydue 2022-07-18
Exploited in the wild
EPSS
16.11%
96.6th percentile
A memory corruption issue was addressed with improved memory handling. This issue is fixed in iOS 13.3.1 and iPadOS 13.3.1, macOS Catalina 10.15.3, tvOS 13.3.1, watchOS 6.1.2. An application may be able to execute arbitrary code with kernel privileges.
Affected
9 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apple | ios | >= unspecified < iOS 13.3.1 and iPadOS 13.3.1 | iOS 13.3.1 and iPadOS 13.3.1 |
| apple | ipados | < 13.3.1 | 13.3.1 |
| apple | iphone_os | < 13.3.1 | 13.3.1 |
| apple | mac_os_x | < 10.15.3 | 10.15.3 |
| apple | macos | >= unspecified < macOS Catalina 10.15.3 | macOS Catalina 10.15.3 |
| apple | tvos | < 13.3.1 | 13.3.1 |
| apple | tvos | >= unspecified < tvOS 13.3.1 | tvOS 13.3.1 |
| apple | watchos | < 6.1.2 | 6.1.2 |
| apple | watchos | >= unspecified < watchOS 6.1.2 | watchOS 6.1.2 |
Detection & IOCsextracted from sources · hover to see the quote
- →Monitor for exploitation of IOAccelCommandQueue2::processSegmentKernelCommand() via command type 2 (kIOAccelKernelCommandCollectTimeStamp), which triggers an out-of-bounds write into the subsequent memory page via shared memory. ↗
- →Look for userspace processes interacting with AGXCommandQueue shared memory in a way that triggers out-of-bounds timestamp writes — the OOB write is visible to userspace via shared memory, making it a detectable side-effect. ↗
- →Flag applications attempting to execute arbitrary code with kernel privileges on unpatched Apple devices (iOS < 13.3.1, macOS < 10.15.3, tvOS < 13.3.1, watchOS < 6.1.2). ↗
- ·The PoC was confirmed on iOS 13 (iPod9,1 17B111) but the researcher notes macOS applicability was not directly tested. ↗
- ·The researcher suspects further shared memory volatility issues exist in AGXCommandQueue beyond the specific OOB timestamp write, meaning the attack surface may be broader than this single CVE. ↗
- ·Prior double-fetch vulnerabilities in AGXAllocationList2::initWithSharedResourceList() were fixed between firmware versions 16A5288q and 16G77; defenders should confirm patch levels carefully across all Apple product lines. ↗
CVSS provenance
nvdv3.17.8HIGHCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
nvdv2.09.3CRITICALAV:N/AC:M/Au:N/C:C/I:C/A:C
vulncheck7.8HIGH
cisa7.8HIGH
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-qhhm-rhwq-mpvm: A memory corruption issue was addressed with improved memory handling
ghsa_unreviewed·2022-05-24
CVE-2020-3837 [HIGH] CWE-119 GHSA-qhhm-rhwq-mpvm: A memory corruption issue was addressed with improved memory handling
A memory corruption issue was addressed with improved memory handling. This issue is fixed in iOS 13.3.1 and iPadOS 13.3.1, macOS Catalina 10.15.3, tvOS 13.3.1, watchOS 6.1.2. An application may be able to execute arbitrary code with kernel privileges.
Project0
An iOS hacker tries Android - Project Zero
project_zero·2020-12-01·CVSS 7.8
CVE-2017-2370 [HIGH] An iOS hacker tries Android - Project Zero
Written by Brandon Azad, when working at Project Zero
One of the amazing aspects of working at Project Zero is having the flexibility to direct my own research agenda. My prior work has almost exclusively focused on iOS exploitation, but back in August, I thought it could be interesting to try writing a kernel exploit for Android to see how it compares. I have two aims for this blog post: First, I will walk you through my full journey from bug description to kernel read/write/execute on the Samsung Galaxy S10, starting from the perspective of a pure-iOS security researcher. Second, I will try to emphasize some of the major security/exploitation differences between the two platforms that I have observed.
You can find the fully-commented exploit code attached in issue 2073.
In November
Project0
One Byte to rule them all - Project Zero
project_zero·2020-07-01·CVSS 7.8
CVE-2020-3837 [HIGH] One Byte to rule them all - Project Zero
Posted by Brandon Azad, Project Zero
One Byte to rule them all, One Byte to type them,
One Byte to map them all, and in userspace bind them
-- Comment above vm_map_copy_t
For the last several years, nearly all iOS kernel exploits have followed the same high-level flow: memory corruption and fake Mach ports are used to gain access to the kernel task port, which provides an ideal kernel read/write primitive to userspace. Recent iOS kernel exploit mitigations like PAC and zone_require seem geared towards breaking the canonical techniques seen over and over again to achieve this exploit flow. But the fact that so many iOS kernel exploits look identical from a high level begs questions: Is targeting the kernel task port really the best exploit flow? Or has the convergence on this strategy
Project0
A survey of recent iOS kernel exploits - Project Zero
project_zero·2020-06-01
CVE-2016-7644 A survey of recent iOS kernel exploits - Project Zero
Posted by Brandon Azad, Project Zero
I recently found myself wishing for a single online reference providing a brief summary of the high-level exploit flow of every public iOS kernel exploit in recent years; since no such document existed, I decided to create it here.
This post summarizes original iOS kernel exploits from local app context targeting iOS 10 through iOS 13, focusing on the high-level exploit flow from the initial primitive granted by the vulnerability to kernel read/write. At the end of this post, we will briefly look at iOS kernel exploit mitigations (in both hardware and software) and how they map onto the techniques used in the exploits.
This isn't your typical P0 blog post: There is no gripping zero-day exploitation, or novel exploitation research, or thrilling mal
VulnCheck
Apple Multiple Products Memory Corruption Vulnerability
vulncheck·2020·CVSS 7.8
CVE-2020-3837 [HIGH] CWE-787 Apple Multiple Products Memory Corruption Vulnerability
Apple Multiple Products Memory Corruption Vulnerability
Apple iOS, iPadOS, macOS, tvOS, and watchOS contain a memory corruption vulnerability that could allow an application to execute code with kernel privileges.
Affected: Apple Multiple Products
Required Action: Apply updates per vendor instructions.
Exploitation References: https://blog.google/threat-analysis-group/italian-spyware-vendor-targets-users-in-italy-and-kazakhstan/; https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; https://blog.google/threat-analysis-group/spyware-vendors-use-0-days-and-n-days-against-popular-platforms/; https://www.threatfabric.com/blogs/lightspy-implant-for-ios
Remediation Due: 2022-07-18
CISA
Apple Multiple Products Memory Corruption Vulnerability
cisa·2022-06-27·CVSS 7.8
CVE-2020-3837 [HIGH] CWE-787 Apple Multiple Products Memory Corruption Vulnerability
Vulnerability: Apple Multiple Products Memory Corruption Vulnerability
Affected: Apple Multiple Products
Apple iOS, iPadOS, macOS, tvOS, and watchOS contain a memory corruption vulnerability that could allow an application to execute code with kernel privileges.
Required Action: Apply updates per vendor instructions.
Notes: https://nvd.nist.gov/vuln/detail/CVE-2020-3837
Remediation Due Date: 2022-07-18
No detection rules found.
No writeups or analysis indexed.
https://support.apple.com/HT210918https://support.apple.com/HT210919https://support.apple.com/HT210920https://support.apple.com/HT210921https://support.apple.com/HT210918https://support.apple.com/HT210919https://support.apple.com/HT210920https://support.apple.com/HT210921https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-3837
2020-02-27
Published
2022-06-27
Added to CISA KEV
Exploited in the wild