Buffer Overflow Vulnerability in Apple iOS and macOS Devices Disclosed
A researcher has disclosed a buffer overflow vulnerability in Apple’s XNU operating system kernel that allows attackers on a local network to reboot Apple’s iOS and macOS devices and could potentially lead to remote code execution.
Contexte
On October 30, researcher Kevin Backhouse of Semmle published a blog on his discovery of a buffer overflow vulnerability in Apple’s XNU operating system kernel (CVE-2018-4407). Specifically, the vulnerability exists in the networking code for XNU for how packets are handled. The vulnerability affects OS X, macOS and iOS devices. Backhouse released a proof of concept (PoC) video demonstrating how this vulnerability can be used to crash macOS and iOS devices on a local network.
The PoC has been withheld to allow time for Apple users to upgrade their devices.
Impact assessment
According to Backhouse, this vulnerability affects iOS devices running iOS 11 and earlier. It also affects legacy devices running Apple’s OS X operating system from El Capitan and earlier, as well as macOS Sierra and High Sierra. The vulnerability was reported to Apple in August 2018 and it had been patched in iOS 12 and macOS Mojave.
Vulnerability details
This vulnerability allows a local network attacker to send a specially crafted Internet Protocol (IP) packet to unsuspecting Apple users that triggers a device reboot (or denial of service). While not demonstrated, Backhouse reports that this vulnerability could lead to remote code execution because an attacker can “control the size and content of the heap buffer overflow.” Additionally, he asserts, “the vulnerability is in such a fundamental part of the networking code that anti-virus software will not protect you[...] It also doesn't matter what software you are running on the device - the malicious packet will still trigger the vulnerability even if you don't have any ports open.”
Urgently required actions
Apple users should upgrade to the latest versions of their respective operating systems. In this case, both iOS 12 and macOS Mojave (10.14) have addressed this vulnerability. Apple has also addressed this vulnerability in macOS Sierra and macOS High Sierra.
Identification des systèmes affectés
A list of Tenable plugins to identify this vulnerability will appear here as they’re released.
Où trouver plus d'informations
- Kernel RCE caused by buffer overflow in Apple's ICMP packet-handling code (CVE-2018-4407)
- Video of PoC for CVE-2018-4407
- About the security content of iOS 12
- About the security content of macOS Mojave 10.14
- Security Update 2018-001 High Sierra, Security Update 2018-005 Sierra
Learn more about Tenable.io, the first Cyber Exposure platform for holistic management of your modern attack surface. Get a free 60-day trial of Tenable.io Vulnerability Management.
Articles connexes
CVE-2024-20353, CVE-2024-20359: Frequently Asked Questions About ArcaneDoor
April 25, 2024Frequently asked questions about CVE-2024-20353 and CVE-2024-20359, two vulnerabilities associated with “ArcaneDoor,” the espionage-related campaign targeting Cisco Adaptive Security Appliances.
Operational Technology in the DoD: Ensuring a Secure and Efficient Power Grid
April 19, 2024In an evolving threat landscape, the DoD must make sure that its mission-critical operations don’t experience power outages.
Strengthening the Nessus Software Supply Chain with SLSA
April 16, 2024You know Tenable as a cybersecurity industry leader whose world-class exposure management products are trusted by our approximately 43,000 customers, including about 60% of the Fortune 500. But sometimes we like to give you a peek behind the curtain to share how we protect our own house against cyberattacks – and that’s what this blog is about. Today we’re sharing our experience adopting the supply-chain security framework SLSA, with the hopes that the lessons we learned will be helpful to you.
CVE-2024-20353, CVE-2024-20359: Frequently Asked Questions About ArcaneDoor
April 25, 2024Frequently asked questions about CVE-2024-20353 and CVE-2024-20359, two vulnerabilities associated with “ArcaneDoor,” the espionage-related campaign targeting Cisco Adaptive Security Appliances.
CVE-2024-4040: CrushFTP Virtual File System (VFS) Sandbox Escape Vulnerability Exploited
April 23, 2024A zero-day vulnerability in CrushFTP was exploited in the wild against multiple U.S. entities prior to fixed versions becoming available as the vendor recommends customers upgrade as soon as possible.
Operational Technology in the DoD: Ensuring a Secure and Efficient Power Grid
April 19, 2024In an evolving threat landscape, the DoD must make sure that its mission-critical operations don’t experience power outages.
- Vulnerability Management