CVE-2019-8835
Apple macOS apfs Use-After-Free Privilege Escalation Vulnerability
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
0Exploited in Wild
-Decision
Descriptions
Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in tvOS 13.3, iCloud for Windows 10.9, iOS 13.3 and iPadOS 13.3, Safari 13.0.4, iTunes 12.10.3 for Windows, iCloud for Windows 7.16. Processing maliciously crafted web content may lead to arbitrary code execution.
Se abordó múltiples problemas de corrupción de memoria con un manejo de la memoria mejorada. Este problema se corrigió en tvOS versión 13.3, iCloud para Windows versión 10.9, iOS versión 13.3 y iPadOS versión 13.3, Safari versión 13.0.4, iTunes versión 12.10.3 para Windows, iCloud para Windows versión 7.16. El procesamiento de contenido web diseñado maliciosamente puede conllevar a una ejecución de código arbitraria
This vulnerability allows local attackers to escalate privileges on affected installations of Apple macOS. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.
The specific flaw exists within the apfs kernel extension. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this to escalate privileges and execute code in the context of the kernel.
CVSS Scores
SSVC
- Decision:-
Timeline
- 2019-02-18 CVE Reserved
- 2019-12-12 CVE Published
- 2024-08-04 CVE Updated
- 2024-10-20 EPSS Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
- CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer
- CWE-787: Out-of-bounds Write
CAPEC
References (8)
| URL | Tag | Source |
|---|
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|---|---|
| https://support.apple.com/en-us/HT210785 | 2021-05-18 | |
| https://support.apple.com/en-us/HT210790 | 2021-05-18 | |
| https://support.apple.com/en-us/HT210792 | 2021-05-18 | |
| https://support.apple.com/en-us/HT210793 | 2021-05-18 | |
| https://support.apple.com/en-us/HT210794 | 2021-05-18 | |
| https://support.apple.com/en-us/HT210795 | 2021-05-18 | |
| https://access.redhat.com/security/cve/CVE-2019-8835 | 2020-11-04 | |
| https://bugzilla.redhat.com/show_bug.cgi?id=1816684 | 2020-11-04 |
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Apple Search vendor "Apple" | Icloud Search vendor "Apple" for product "Icloud" | < 7.16 Search vendor "Apple" for product "Icloud" and version " < 7.16" | windows |
Affected
| ||||||
| Apple Search vendor "Apple" | Icloud Search vendor "Apple" for product "Icloud" | >= 10.0 < 10.9 Search vendor "Apple" for product "Icloud" and version " >= 10.0 < 10.9" | windows |
Affected
| ||||||
| Apple Search vendor "Apple" | Itunes Search vendor "Apple" for product "Itunes" | < 12.10.3 Search vendor "Apple" for product "Itunes" and version " < 12.10.3" | windows |
Affected
| ||||||
| Apple Search vendor "Apple" | Safari Search vendor "Apple" for product "Safari" | < 13.0.4 Search vendor "Apple" for product "Safari" and version " < 13.0.4" | - |
Affected
| ||||||
| Apple Search vendor "Apple" | Ipados Search vendor "Apple" for product "Ipados" | < 13.3 Search vendor "Apple" for product "Ipados" and version " < 13.3" | - |
Affected
| ||||||
| Apple Search vendor "Apple" | Iphone Os Search vendor "Apple" for product "Iphone Os" | < 13.3 Search vendor "Apple" for product "Iphone Os" and version " < 13.3" | - |
Affected
| ||||||
| Apple Search vendor "Apple" | Tvos Search vendor "Apple" for product "Tvos" | < 13.3 Search vendor "Apple" for product "Tvos" and version " < 13.3" | - |
Affected
| ||||||
| Redhat Search vendor "Redhat" | Enterprise Linux Desktop Search vendor "Redhat" for product "Enterprise Linux Desktop" | 7.0 Search vendor "Redhat" for product "Enterprise Linux Desktop" and version "7.0" | - |
Affected
| ||||||
| Redhat Search vendor "Redhat" | Enterprise Linux Server Search vendor "Redhat" for product "Enterprise Linux Server" | 7.0 Search vendor "Redhat" for product "Enterprise Linux Server" and version "7.0" | - |
Affected
| ||||||
| Redhat Search vendor "Redhat" | Enterprise Linux Workstation Search vendor "Redhat" for product "Enterprise Linux Workstation" | 7.0 Search vendor "Redhat" for product "Enterprise Linux Workstation" and version "7.0" | - |
Affected
| ||||||