Buffer Overflow Vulnerability in Apple iOS and macOS Devices Disclosed
A researcher has disclosed a buffer overflow vulnerability in Apple’s XNU operating system kernel that allows attackers on a local network to reboot Apple’s iOS and macOS devices and could potentially lead to remote code execution.
Background
On October 30, researcher Kevin Backhouse of Semmle published a blog on his discovery of a buffer overflow vulnerability in Apple’s XNU operating system kernel (CVE-2018-4407). Specifically, the vulnerability exists in the networking code for XNU for how packets are handled. The vulnerability affects OS X, macOS and iOS devices. Backhouse released a proof of concept (PoC) video demonstrating how this vulnerability can be used to crash macOS and iOS devices on a local network.
The PoC has been withheld to allow time for Apple users to upgrade their devices.
Impact assessment
According to Backhouse, this vulnerability affects iOS devices running iOS 11 and earlier. It also affects legacy devices running Apple’s OS X operating system from El Capitan and earlier, as well as macOS Sierra and High Sierra. The vulnerability was reported to Apple in August 2018 and it had been patched in iOS 12 and macOS Mojave.
Vulnerability details
This vulnerability allows a local network attacker to send a specially crafted Internet Protocol (IP) packet to unsuspecting Apple users that triggers a device reboot (or denial of service). While not demonstrated, Backhouse reports that this vulnerability could lead to remote code execution because an attacker can “control the size and content of the heap buffer overflow.” Additionally, he asserts, “the vulnerability is in such a fundamental part of the networking code that anti-virus software will not protect you[...] It also doesn't matter what software you are running on the device - the malicious packet will still trigger the vulnerability even if you don't have any ports open.”
Urgently required actions
Apple users should upgrade to the latest versions of their respective operating systems. In this case, both iOS 12 and macOS Mojave (10.14) have addressed this vulnerability. Apple has also addressed this vulnerability in macOS Sierra and macOS High Sierra.
Identifying affected systems
A list of Tenable plugins to identify this vulnerability will appear here as they’re released.
Get more information
- Kernel RCE caused by buffer overflow in Apple's ICMP packet-handling code (CVE-2018-4407)
- Video of PoC for CVE-2018-4407
- About the security content of iOS 12
- About the security content of macOS Mojave 10.14
- Security Update 2018-001 High Sierra, Security Update 2018-005 Sierra
Learn more about Tenable.io, the first Cyber Exposure platform for holistic management of your modern attack surface. Get a free 60-day trial of Tenable.io Vulnerability Management.
Related Articles
Volt Typhoon: U.S. Critical Infrastructure Targeted by State-Sponsored Actors
November 19, 2024Volt Typhoon, a state-sponsored actor linked to the People’s Republic of China, has consistently targeted U.S. critical infrastructure with the intent to maintain persistent access. Tenable Research examines the tactics, techniques and procedures of this threat actor.
CVE-2024-0012, CVE-2024-9474: Zero-Day Vulnerabilities in Palo Alto PAN-OS Exploited In The Wild
November 18, 2024Palo Alto Networks confirmed two zero-day vulnerabilities were exploited as part of attacks in the wild against PAN-OS devices, with one being attributed to Operation Lunar Peek.
Microsoft’s November 2024 Patch Tuesday Addresses 87 CVEs (CVE-2024-43451, CVE-2024-49039)
November 12, 2024Microsoft addresses 87 CVEs and one advisory (ADV240001) in its November 2024 Patch Tuesday release, with four critical vulnerabilities and four zero-day vulnerabilities, including two that were exploited in the wild.
Walking the Walk: How Tenable Embraces Its "Secure by Design" Pledge to CISA
November 25, 2024As a cybersecurity leader, Tenable was proud to be one of the original signatories of CISA’s “Secure by Design" pledge” earlier this year. Our embrace of this pledge underscores our commitment to security-first principles and reaffirms our dedication to shipping robust, secure products that our users can trust. Read on to learn how we’re standing behind our pledge.
Cybersecurity Snapshot: Prompt Injection and Data Disclosure Top OWASP’s List of Cyber Risks for GenAI LLM Apps
November 22, 2024Don’t miss OWASP’s update to its “Top 10 Risks for LLMs” list. Plus, the ranking of the most harmful software weaknesses is out. Meanwhile, critical infrastructure orgs have a new framework for using AI securely. And get the latest on the BianLian ransomware gang and on the challenges of protecting water and transportation systems against cyberattacks.
Active Directory Under Attack: Five Eyes Guidance Targets Crucial Security Gaps
November 21, 2024A landmark global report from cybersecurity agencies emphasizes 17 attack techniques against Microsoft Active Directory and cautions organizations to step up protections. In the first of our two-part series, we offer five steps you can take today to shore up your AD defenses.
- Vulnerability Management