Apple watchOS up to 5.2.0 Kernel type confusion

Summaryinfo

A vulnerability, which was classified as critical, has been found in Apple watchOS up to 5.2.0. Impacted is an unknown function of the component Kernel. The manipulation leads to type confusion. This vulnerability is referenced as CVE-2019-8591. Remote exploitation of the attack is possible. Furthermore, an exploit is available. It is advisable to upgrade the affected component.

Detailsinfo

A vulnerability, which was classified as critical, has been found in Apple watchOS up to 5.2.0 (Smartwatch Operating System). This issue affects an unknown functionality of the component Kernel. The manipulation with an unknown input leads to a type confusion vulnerability. Using CWE to declare the problem leads to CWE-843. The product allocates or initializes a resource such as a pointer, object, or variable using one type, but it later accesses that resource using a type that is incompatible with the original type. Impacted is confidentiality, integrity, and availability. The summary by CVE is:

A type confusion issue was addressed with improved memory handling. This issue is fixed in iOS 12.3, macOS Mojave 10.14.5, tvOS 12.3, watchOS 5.2.1. An application may be able to cause unexpected system termination or write kernel memory.

The weakness was published 05/13/2019 with Google Project Zero as HT210122 as confirmed advisory (Website). It is possible to read the advisory at support.apple.com. The identification of this vulnerability is CVE-2019-8591 since 02/18/2019. The exploitation is known to be difficult. The attack may be initiated remotely. No form of authentication is needed for a successful exploitation. It demands that the victim is doing some kind of user interaction. Technical details are unknown but a public exploit is available. The advisory points out:

A type confusion issue was addressed with improved memory handling.

The exploit is available at exploit-db.com. It is declared as proof-of-concept. The commercial vulnerability scanner Qualys is able to test this issue with plugin 371785 (Apple macOS Mojave 10.14.5, Security Update 2019-003 High Sierra, Security Update 2019-003 Sierra Not Installed (HT210119)).

Upgrading to version 5.2.1 eliminates this vulnerability. A possible mitigation has been published immediately after the disclosure of the vulnerability.

The vulnerability is also documented in the vulnerability database at Exploit-DB (46891). Similar entries are available at VDB-134840, VDB-134841, VDB-134842 and VDB-134843. Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Type

• Smartwatch Operating System

Vendor

• Apple

Name

• watchOS

Version

• 5.0
• 5.1
• 5.2.0

License

• commercial

Website

• Vendor: https://www.apple.com/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion