CVE-2020-9870
published 2020-10-16CVE-2020-9870: A logic issue was addressed with improved validation. This issue is fixed in iOS 13.6 and iPadOS 13.6, macOS Catalina 10.15.6, tvOS 13.4.8. An attacker with…
PriorityP180high8.8CVSS 3.1
AVNACLPRLUINSUCHIHAH
ITWVulnCheck KEV
Exploited in the wild
EPSS
2.00%
78.5th percentile
A logic issue was addressed with improved validation. This issue is fixed in iOS 13.6 and iPadOS 13.6, macOS Catalina 10.15.6, tvOS 13.4.8. An attacker with memory write capability may be able to bypass pointer authentication codes and run arbitrary code.
Affected
8 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apple | ios | >= unspecified < iOS 13.6 and iPadOS 13.6 | iOS 13.6 and iPadOS 13.6 |
| apple | ipados | < 13.6 | 13.6 |
| apple | iphone_os | < 13.6 | 13.6 |
| apple | mac_os_x | < 10.15.6 | 10.15.6 |
| apple | macos | >= unspecified < macOS Catalina 10.15.6 | macOS Catalina 10.15.6 |
| apple | macos_catalina_10.15.6_security_update_2020-004_mojave_security_update_2020-004 | — | — |
| apple | tvos | < 13.4.8 | 13.4.8 |
| apple | tvos | >= unspecified < tvOS 13.4.8 | tvOS 13.4.8 |
Detection & IOCsextracted from sources · hover to see the quote
- →CVE-2020-9870 affects the Clang compiler component; binaries compiled with vulnerable Clang versions on affected Apple platforms (iOS <13.6, iPadOS <13.6, macOS Catalina <10.15.6, tvOS <13.4.8) may not correctly enforce pointer authentication codes (PAC), allowing PAC bypass by an attacker with memory write capability. ↗
- →Exploitation requires an attacker to already have memory write capability on the target; detection should focus on memory corruption primitives or write primitives being chained with code-reuse/PAC-bypass techniques on affected Apple ARM64e platforms. ↗
- ·The vulnerability is a compiler-level logic issue in Clang, not a runtime library or OS kernel bug per se — affected binaries must have been compiled with the vulnerable Clang toolchain shipped with Xcode for the impact to apply. Patching requires rebuilding affected binaries with a fixed Clang version included in the listed OS updates. ↗
CVSS provenance
nvdv3.18.8HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
nvdv2.06.5MEDIUMAV:N/AC:L/Au:S/C:P/I:P/A:P
vulncheck8.8HIGH
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-899c-g9fr-8ccx: A logic issue was addressed with improved validation
ghsa_unreviewed·2022-05-24
CVE-2020-9870 [HIGH] CWE-20 GHSA-899c-g9fr-8ccx: A logic issue was addressed with improved validation
A logic issue was addressed with improved validation. This issue is fixed in iOS 13.6 and iPadOS 13.6, macOS Catalina 10.15.6, tvOS 13.4.8. An attacker with memory write capability may be able to bypass pointer authentication codes and run arbitrary code.
Project0
JITSploitation II: Getting Read/Write - Project Zero
project_zero·2020-09-01·CVSS 8.8
CVE-2020-9802 [HIGH] JITSploitation II: Getting Read/Write - Project Zero
Posted by Samuel Groß, Project Zero
This three-part series highlights the technical challenges involved in finding and exploiting JavaScript engine vulnerabilities in modern web browsers and evaluates current exploit mitigation technologies. The exploited vulnerability, CVE-2020-9802, was fixed in iOS 13.5, while two of the mitigation bypasses, CVE-2020-9870 and CVE-2020-9910, were fixed in iOS 13.6.
This is the second part in a series about a Safari renderer exploit from a JIT bug. In Part 1, a vulnerability in the DFG JIT’s implementation of Common-Subexpression Elimination was discussed. The second part starts from the well-known addrof and fakeobj primitives and shows how stable, arbitrary memory read/write can be constructed from it. For that, the StructureID randomization mitiga
Project0
JITSploitation III: Subverting Control Flow - Project Zero
project_zero·2020-09-01·CVSS 8.8
CVE-2020-9802 [HIGH] JITSploitation III: Subverting Control Flow - Project Zero
Posted by Samuel Groß, Project Zero
This three-part series highlights the technical challenges involved in finding and exploiting JavaScript engine vulnerabilities in modern web browsers and evaluates current exploit mitigation technologies. The exploited vulnerability, CVE-2020-9802, was fixed in iOS 13.5, while two of the mitigation bypasses, CVE-2020-9870 and CVE-2020-9910, were fixed in iOS 13.6.
This post is third in a series about a Safari renderer exploit. Part 1 discussed a JIT compiler vulnerability in JSC and Part 2 showed how it could be turned into a reliable read/write primitive despite various mitigations. The purpose of this post is to provide an overview of the various code execution mitigations present in WebKit on iOS 13 and to discuss different approaches for bypas
Project0
JITSploitation I: A JIT Bug - Project Zero
project_zero·2020-09-01·CVSS 8.8
CVE-2020-9802 [HIGH] JITSploitation I: A JIT Bug - Project Zero
By Samuel Groß, Project Zero
This three-part series highlights the technical challenges involved in finding and exploiting JavaScript engine vulnerabilities in modern web browsers and evaluates current exploit mitigation technologies. The exploited vulnerability, CVE-2020-9802, was fixed in iOS 13.5, while two of the mitigation bypasses, CVE-2020-9870 and CVE-2020-9910, were fixed in iOS 13.6.
How might a browser renderer exploit look like in 2020? I set out to answer that question in January this year. Since it’s one of my favorite areas in computer science, I wanted to find a JIT compiler vulnerability, and I was especially interested in trying to find (new) types of vulnerabilities that my fuzzer would have a hard time finding.
As WebKit (on iOS and likely soon on ARM-powered ma
VulnCheck
Apple ipados Improper Input Validation
vulncheck·2020·CVSS 8.8
CVE-2020-9870 [HIGH] Apple ipados Improper Input Validation
Apple ipados Improper Input Validation
A logic issue was addressed with improved validation. This issue is fixed in iOS 13.6 and iPadOS 13.6, macOS Catalina 10.15.6, tvOS 13.4.8. An attacker with memory write capability may be able to bypass pointer authentication codes and run arbitrary code.
Affected: Apple ipados
Required Action: Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.
Exploitation References: https://www.threatfabric.com/blogs/lightspy-implant-for-ios
Apple
CVE-2020-9870: macOS Catalina 10.15.6, Security Update 2020-004 Mojave, Security Update 2020-004 High Sierra
vendor_apple·2020-07-15·CVSS 8.8
CVE-2020-9870 [HIGH] CVE-2020-9870: macOS Catalina 10.15.6, Security Update 2020-004 Mojave, Security Update 2020-004 High Sierra
Apple Security Update: About the security content of macOS Catalina 10.15.6, Security Update 2020-004 Mojave, Security Update 2020-004 High Sierra
Product: macOS Catalina 10.15.6, Security Update 2020-004 Mojave, Security Update 2020-004 High Sierra
CVE: CVE-2020-9870
Component: Clang
Impact: Clang may generate machine code that does not correctly enforce pointer authentication codes
Description: A logic issue was addressed with improved validation.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2020-10-16
Published
Exploited in the wild