Apple watchOS up to 4.3.1 Kernel out-of-bounds

Summaryinfo

A vulnerability classified as critical has been found in Apple watchOS up to 4.3.1. The impacted element is an unknown function of the component Kernel. Performing a manipulation results in out-of-bounds. This vulnerability is cataloged as CVE-2018-4282. The attack must be initiated from a local position. There is no exploit available. It is recommended to upgrade the affected component.

Detailsinfo

A vulnerability was found in Apple watchOS up to 4.3.1 (Smartwatch Operating System). It has been classified as critical. This affects some unknown processing of the component Kernel. The manipulation with an unknown input leads to a out-of-bounds vulnerability. CWE is classifying the issue as CWE-125. The product reads data past the end, or before the beginning, of the intended buffer. This is going to have an impact on confidentiality, integrity, and availability. The summary by CVE is:

An out-of-bounds read issue existed that led to the disclosure of kernel memory. This was addressed with improved input validation. This issue affected versions prior to iOS 11.4.1, tvOS 11.4.1, watchOS 4.3.2.

The bug was discovered 07/09/2018. The weakness was shared 07/09/2018 with Qihoo 360 as HT208935 as confirmed advisory (Website). The advisory is shared at support.apple.com. This vulnerability is uniquely identified as CVE-2018-4282 since 01/02/2018. The exploitability is told to be easy. An attack has to be approached locally. No form of authentication is needed for exploitation. Neither technical details nor an exploit are publicly available. The advisory points out:

An out-of-bounds read issue existed that led to the disclosure of kernel memory. This was addressed with improved input validation.

The vulnerability scanner Nessus provides a plugin with the ID 111110 (Apple TV < 11.4.1 Multiple Vulnerabilities), which helps to determine the existence of the flaw in a target environment. It is assigned to the family Misc. and running in the context r.

Upgrading to version 4.3.2 eliminates this vulnerability. A possible mitigation has been published immediately after the disclosure of the vulnerability.

The vulnerability is also documented in the vulnerability database at Tenable (111110). The entries VDB-120959, VDB-120973, VDB-120987 and VDB-120989 are related to this item. If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Type

• Smartwatch Operating System

Vendor

• Apple

Name

• watchOS

Version

• 4.3.0
• 4.3.1

License

• commercial

Website

• Vendor: https://www.apple.com/

CPE 2.3info

• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion