Sign-up

ID

VAR-201904-1339


CVE

CVE-2018-4268


TITLE

macOS High Sierra Memory corruption vulnerability

Trust: 0.8

sources: JVNDB: JVNDB-2018-014836

DESCRIPTION

A memory corruption issue was addressed with improved memory handling. This issue affected versions prior to macOS High Sierra 10.13.6. macOS High Sierra Contains a memory corruption vulnerability due to a flaw in memory handling.Information is obtained, information is altered, and service operation is disrupted (DoS) There is a possibility of being put into a state. This vulnerability allows local attackers to escalate privileges on vulnerable installations of Apple macOS. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.The specific flaw exists within the handling of APFS. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to escalate privileges and execute code as the kernel. Apple macOS High Sierra is a set of dedicated operating systems developed by Apple (Apple) for Mac computers. APFS is one of the Apple device-specific file system components. The vulnerability stems from the fact that when the network system or product performs operations on the memory, it does not correctly verify the data boundary, resulting in the wrong execution of the associated memory location. read and write operations. Attackers can exploit this vulnerability to cause buffer overflow or heap overflow, etc. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 APPLE-SA-2018-10-30-14 Additional information for APPLE-SA-2018-7-9-4 macOS High Sierra 10.13.6, Security Update 2018-004 Sierra, Security Update 2018-004 El Capitan macOS High Sierra 10.13.6, Security Update 2018-004 Sierra, and Security Update 2018-004 El Capitan address the following: AMD Available for: macOS High Sierra 10.13.5 Impact: A malicious application may be able to determine kernel memory layout Description: An information disclosure issue was addressed by removing the vulnerable code. CVE-2018-4268: Mac working with Trend Micro's Zero Day Initiative ATS Available for: macOS High Sierra 10.13.5 Impact: A malicious application may be able to gain root privileges Description: A type confusion issue was addressed with improved memory handling. CVE-2018-4285: Mohamed Ghannam (@_simo36) Bluetooth Available for: MacBook Pro (15-inch, 2018), and MacBook Pro (13-inch, 2018, Four Thunderbolt 3 Ports) Other Mac models were addressed with macOS High Sierra 10.13.5. Impact: An attacker in a privileged network position may be able to intercept Bluetooth traffic Description: An input validation issue existed in Bluetooth. CVE-2018-5383: Lior Neumann and Eli Biham CFNetwork Available for: macOS High Sierra 10.13.5 Impact: Cookies may unexpectedly persist in Safari Description: A cookie management issue was addressed with improved checks. CVE-2018-4293: an anonymous researcher CoreCrypto Available for: OS X El Capitan 10.11.6, macOS Sierra 10.12.6, macOS High Sierra 10.13.5 Impact: A malicious application may be able to break out of its sandbox Description: A memory corruption issue was addressed with improved input validation. CVE-2018-4269: Abraham Masri (@cheesecakeufo) CUPS Available for: OS X El Capitan 10.11.6, macOS Sierra 10.12.6, macOS High Sierra 10.13.5 Impact: An attacker in a privileged position may be able to perform a denial of service attack Description: A null pointer dereference was addressed with improved validation. CVE-2018-4276: Jakub Jirasek of Secunia Research at Flexera Entry added October 30, 2018 DesktopServices Available for: macOS Sierra 10.12.6 Impact: A local user may be able to view sensitive user information Description: A permissions issue existed in which execute permission was incorrectly granted. CVE-2018-4178: Arjen Hendrikse IOGraphics Available for: macOS High Sierra 10.13.5 Impact: A local user may be able to read kernel memory Description: An out-of-bounds read issue existed that led to the disclosure of kernel memory. This was addressed with improved input validation. CVE-2018-4283: @panicaII working with Trend Micro's Zero Day Initiative Kernel Available for: OS X El Capitan 10.11.6, macOS Sierra 10.12.6, macOS High Sierra 10.13.5 Impact: Systems using IntelA(r) Core-based microprocessors may potentially allow a local process to infer data utilizing Lazy FP state restore from another process through a speculative execution side channel Description: Lazy FP state restore instead of eager save and restore of the state upon a context switch. Lazy restored states are potentially vulnerable to exploits where one process may infer register values of other processes through a speculative execution side channel that infers their value. An information disclosure issue was addressed with FP/SIMD register state sanitization. CVE-2018-3665: Julian Stecklina of Amazon Germany, Thomas Prescher of Cyberus Technology GmbH (cyberus-technology.de), Zdenek Sojka of SYSGO AG (sysgo.com), and Colin Percival Kernel Available for: macOS High Sierra 10.13.5 Impact: Mounting a maliciously crafted NFS network share may lead to arbitrary code execution with system privileges Description: Multiple memory corruption issues were addressed with improved memory handling. CVE-2018-4259: Kevin Backhouse of Semmle and LGTM.com CVE-2018-4286: Kevin Backhouse of Semmle and LGTM.com CVE-2018-4287: Kevin Backhouse of Semmle and LGTM.com CVE-2018-4288: Kevin Backhouse of Semmle and LGTM.com CVE-2018-4291: Kevin Backhouse of Semmle and LGTM.com Entry added October 30, 2018 libxpc Available for: OS X El Capitan 10.11.6, macOS Sierra 10.12.6, macOS High Sierra 10.13.5 Impact: An application may be able to gain elevated privileges Description: A memory corruption issue was addressed with improved memory handling. CVE-2018-4280: Brandon Azad libxpc Available for: macOS High Sierra 10.13.5 Impact: A malicious application may be able to read restricted memory Description: An out-of-bounds read was addressed with improved input validation. CVE-2018-4248: Brandon Azad LinkPresentation Available for: macOS High Sierra 10.13.5 Impact: Visiting a malicious website may lead to address bar spoofing Description: A spoofing issue existed in the handling of URLs. CVE-2018-4277: xisigr of Tencent's Xuanwu Lab (tencent.com) Perl Available for: macOS High Sierra 10.13.5 Impact: Multiple buffer overflow issues existed in Perl Description: Multiple issues in Perl were addressed with improved memory handling. CVE-2018-6797: Brian Carpenter CVE-2018-6913: GwanYeong Kim Entry added October 30, 2018 Ruby Available for: macOS High Sierra 10.13.5 Impact: A remote attacker may be able to cause unexpected application termination or arbitrary code execution Description: Multiple issues in Ruby were addressed in this update. CVE-2017-898 CVE-2017-10784 CVE-2017-14033 CVE-2017-14064 CVE-2017-17405 CVE-2017-17742 CVE-2018-6914 CVE-2018-8777 CVE-2018-8778 CVE-2018-8779 CVE-2018-8780 Entry added October 30, 2018 Additional recognition App Store We would like to acknowledge Jesse Endahl & Stevie Hryciw of Fleetsmith and and Max BA(c)langer of Dropbox for their assistance. Help Viewer We would like to acknowledge Wojciech ReguAa (@_r3ggi) of SecuRing for their assistance. Kernel We would like to acknowledge juwei lin (@panicaII) of Trend Micro working with Trend Micro's Zero Day Initiative for their assistance. Security We would like to acknowledge Brad Dahlsten of Iowa State University for their assistance. Installation note: macOS High Sierra 10.13.6, Security Update 2018-004 Sierra, and Security Update 2018-004 El Capitan may be obtained from the Mac App Store or Apple's Software Downloads web site: https://support.apple.com/downloads/ Information will also be posted to the Apple Security Updates web site: https://support.apple.com/kb/HT201222 This message is signed with Apple's Product Security PGP key, and details are available at: https://www.apple.com/support/security/pgp/ -----BEGIN PGP SIGNATURE----- iQJdBAEBCABHFiEEDNXJVNCJJEAVmJdZeC9tht7TK3EFAlvYkgUpHHByb2R1Y3Qt c2VjdXJpdHktbm9yZXBseUBsaXN0cy5hcHBsZS5jb20ACgkQeC9tht7TK3EgwhAA rut4Qepkh88tcd23FV/Fz6uEdqa2MDPRPhVs6rM5iM7912vhtVZHz1sDUpSwNFe+ Hfdx0qsZaxY1sKjqMejq5mpanjFWhCCWb7MxifGm1HTJRMibuTAW7zVwD51jsG7z GpQtZ8ASaW9NErn+3IPB0O//CCvAKR/qyqn+KyEhYw+xtz2j+dzneB6lpwFkiqG2 0Iz5DQ2Hwms/88byzoXLWljAApvgSeant1YAiShq9bvQ3iWSkLSoo1dEa9jhhGJV jKyc+XloM7AfAHl6sjR6t3Cgdmfpy7s4osx17tqa4B5CYUloBGcZ0SZrL6iJDDvV 5OTsXHCQ9NLwZrdAwIgfcVcs01Y8hVkpjhCmm2InGwREJUtpYefCQ/kIlDa1YOym 3ua/SEO5+UYSVspG45vTdRB6SNSzeWzcQvJohrXavSllttcGyNx9RxMSr9CGxNSE Vjmo30J8D2Oow2hMtK1PWXxI+t4UadO33rL1H2u8ivl9J1BI9sEL0linFTUpEnIS iIRYUdrr+ZduSsC21NBLhMOak61GWYQRSN+p3nbL7fDqZCFdBSwvye4q2MmZG1Op aDePXQWSPgzlXzfi2C6KiR+lSyZlgCwtwhPGlzDFH5MGxr5Tleov98GB4uml91lj PVSMCsvYvRarIh6enmy+SR/6X7gVgrpx4m/fdraBwTw= =e0YF -----END PGP SIGNATURE-----

Trust: 2.7

sources: NVD: CVE-2018-4268 // JVNDB: JVNDB-2018-014836 // ZDI: ZDI-18-602 // VULHUB: VHN-134299 // VULMON: CVE-2018-4268 // PACKETSTORM: 148468 // PACKETSTORM: 148641 // PACKETSTORM: 150118

AFFECTED PRODUCTS

vendor:applemodel:mac os xscope:ltversion:10.13.6

Trust: 1.0

vendor:applemodel:mac os xscope:eqversion:10.13.5

Trust: 0.8

vendor:applemodel:macosscope: - version: -

Trust: 0.7

sources: ZDI: ZDI-18-602 // JVNDB: JVNDB-2018-014836 // NVD: CVE-2018-4268

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2018-4268
value: CRITICAL

Trust: 1.0

NVD: CVE-2018-4268
value: CRITICAL

Trust: 0.8

ZDI: CVE-2018-4268
value: MEDIUM

Trust: 0.7

CNNVD: CNNVD-201808-947
value: CRITICAL

Trust: 0.6

VULHUB: VHN-134299
value: HIGH

Trust: 0.1

VULMON: CVE-2018-4268
value: HIGH

Trust: 0.1

nvd@nist.gov: CVE-2018-4268
severity: HIGH
baseScore: 10.0
vectorString: AV:N/AC:L/AU:N/C:C/I:C/A:C
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: COMPLETE
integrityImpact: COMPLETE
availabilityImpact: COMPLETE
exploitabilityScore: 10.0
impactScore: 10.0
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.9

ZDI: CVE-2018-4268
severity: MEDIUM
baseScore: 6.9
vectorString: AV:L/AC:M/AU:N/C:C/I:C/A:C
accessVector: LOCAL
accessComplexity: MEDIUM
authentication: NONE
confidentialityImpact: COMPLETE
integrityImpact: COMPLETE
availabilityImpact: COMPLETE
exploitabilityScore: 3.4
impactScore: 10.0
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.7

VULHUB: VHN-134299
severity: HIGH
baseScore: 10.0
vectorString: AV:N/AC:L/AU:N/C:C/I:C/A:C
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: COMPLETE
integrityImpact: COMPLETE
availabilityImpact: COMPLETE
exploitabilityScore: 10.0
impactScore: 10.0
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.1

nvd@nist.gov: CVE-2018-4268
baseSeverity: CRITICAL
baseScore: 9.8
vectorString: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: 3.9
impactScore: 5.9
version: 3.0

Trust: 1.8

sources: ZDI: ZDI-18-602 // VULHUB: VHN-134299 // VULMON: CVE-2018-4268 // JVNDB: JVNDB-2018-014836 // CNNVD: CNNVD-201808-947 // NVD: CVE-2018-4268

PROBLEMTYPE DATA

problemtype:CWE-119

Trust: 1.9

sources: VULHUB: VHN-134299 // JVNDB: JVNDB-2018-014836 // NVD: CVE-2018-4268

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-201808-947

TYPE

buffer error

Trust: 0.6

sources: CNNVD: CNNVD-201808-947

CONFIGURATIONS

sources:
            
            
            JVNDB: JVNDB-2018-014836

PATCH
title:HT208937url:https://support.apple.com/en-us/HT208937
Trust: 1.5
title:HT208937url:https://support.apple.com/ja-jp/HT208937
Trust: 0.8
title:Apple macOS High Sierra APFS Fixes for component security vulnerabilitiesurl:http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=84370
Trust: 0.6
title:Apple: macOS High Sierra 10.13.6, Security Update 2018-004 Sierra, Security Update 2018-004 El Capitanurl:https://vulmon.com/vendoradvisory?qidtp=apple_security_advisories&qid=6271728c896ad06d4d117e77589eea2f
Trust: 0.1
sources:
            
            
            ZDI: ZDI-18-602 // 
            
            
            
            VULMON: CVE-2018-4268 // 
            
            
            
            JVNDB: JVNDB-2018-014836 // 
            
            
            
            CNNVD: CNNVD-201808-947

EXTERNAL IDS
db:NVDid:CVE-2018-4268
Trust: 3.6
db:JVNid:JVNVU93082496
Trust: 0.8
db:JVNDBid:JVNDB-2018-014836
Trust: 0.8
db:ZDI_CANid:ZDI-CAN-6132
Trust: 0.7
db:ZDIid:ZDI-18-602
Trust: 0.7
db:CNNVDid:CNNVD-201808-947
Trust: 0.7
db:VULHUBid:VHN-134299
Trust: 0.1
db:VULMONid:CVE-2018-4268
Trust: 0.1
db:PACKETSTORMid:148468
Trust: 0.1
db:PACKETSTORMid:148641
Trust: 0.1
db:PACKETSTORMid:150118
Trust: 0.1
sources:
            
            
            ZDI: ZDI-18-602 // 
            
            
            
            VULHUB: VHN-134299 // 
            
            
            
            VULMON: CVE-2018-4268 // 
            
            
            
            JVNDB: JVNDB-2018-014836 // 
            
            
            
            PACKETSTORM: 148468 // 
            
            
            
            PACKETSTORM: 148641 // 
            
            
            
            PACKETSTORM: 150118 // 
            
            
            
            CNNVD: CNNVD-201808-947 // 
            
            
            
            NVD: CVE-2018-4268

REFERENCES
url:https://support.apple.com/kb/ht208937
Trust: 1.9
url:https://nvd.nist.gov/vuln/detail/cve-2018-4268
Trust: 1.7
url:https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2018-4268
Trust: 0.8
url:https://jvn.jp/vu/jvnvu93082496/index.html
Trust: 0.8
url:https://support.apple.com/en-us/ht208937
Trust: 0.7
url:https://nvd.nist.gov/vuln/detail/cve-2018-3665
Trust: 0.3
url:https://nvd.nist.gov/vuln/detail/cve-2018-4248
Trust: 0.3
url:https://nvd.nist.gov/vuln/detail/cve-2018-4269
Trust: 0.3
url:https://support.apple.com/kb/ht201222
Trust: 0.3
url:https://nvd.nist.gov/vuln/detail/cve-2018-4178
Trust: 0.3
url:https://nvd.nist.gov/vuln/detail/cve-2018-4285
Trust: 0.3
url:https://nvd.nist.gov/vuln/detail/cve-2018-4289
Trust: 0.3
url:https://nvd.nist.gov/vuln/detail/cve-2018-4293
Trust: 0.3
url:https://www.apple.com/support/security/pgp/
Trust: 0.3
url:https://support.apple.com/downloads/
Trust: 0.3
url:https://nvd.nist.gov/vuln/detail/cve-2018-4277
Trust: 0.3
url:https://nvd.nist.gov/vuln/detail/cve-2018-4283
Trust: 0.3
url:https://nvd.nist.gov/vuln/detail/cve-2018-4280
Trust: 0.3
url:https://nvd.nist.gov/vuln/detail/cve-2018-5383
Trust: 0.2
url:https://cwe.mitre.org/data/definitions/119.html
Trust: 0.1
url:https://nvd.nist.gov
Trust: 0.1
url:http://seclists.org/fulldisclosure/2018/jul/33
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2017-14064
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2017-10784
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2018-4288
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2018-8777
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2017-17405
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2018-4276
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2018-4291
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2018-6914
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2018-4286
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2017-14033
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2018-6913
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2018-4259
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2018-6797
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2017-17742
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2018-4287
Trust: 0.1
sources:
            
            
            ZDI: ZDI-18-602 // 
            
            
            
            VULHUB: VHN-134299 // 
            
            
            
            VULMON: CVE-2018-4268 // 
            
            
            
            JVNDB: JVNDB-2018-014836 // 
            
            
            
            PACKETSTORM: 148468 // 
            
            
            
            PACKETSTORM: 148641 // 
            
            
            
            PACKETSTORM: 150118 // 
            
            
            
            CNNVD: CNNVD-201808-947 // 
            
            
            
            NVD: CVE-2018-4268

CREDITS
Mac
Trust: 1.3
sources:
            
            
            ZDI: ZDI-18-602 // 
            
            
            
            CNNVD: CNNVD-201808-947

SOURCES
db:ZDIid:ZDI-18-602
db:VULHUBid:VHN-134299
db:VULMONid:CVE-2018-4268
db:JVNDBid:JVNDB-2018-014836
db:PACKETSTORMid:148468
db:PACKETSTORMid:148641
db:PACKETSTORMid:150118
db:CNNVDid:CNNVD-201808-947
db:NVDid:CVE-2018-4268

LAST UPDATE DATE
2024-11-23T21:20:15.694000+00:00

SOURCES UPDATE DATE
db:ZDIid:ZDI-18-602date:2018-07-10T00:00:00
db:VULHUBid:VHN-134299date:2019-04-04T00:00:00
db:VULMONid:CVE-2018-4268date:2019-04-04T00:00:00
db:JVNDBid:JVNDB-2018-014836date:2019-04-16T00:00:00
db:CNNVDid:CNNVD-201808-947date:2019-04-15T00:00:00
db:NVDid:CVE-2018-4268date:2024-11-21T04:07:05.427

SOURCES RELEASE DATE
db:ZDIid:ZDI-18-602date:2018-07-10T00:00:00
db:VULHUBid:VHN-134299date:2019-04-03T00:00:00
db:VULMONid:CVE-2018-4268date:2019-04-03T00:00:00
db:JVNDBid:JVNDB-2018-014836date:2019-04-16T00:00:00
db:PACKETSTORMid:148468date:2018-07-09T20:20:22
db:PACKETSTORMid:148641date:2018-07-23T13:01:11
db:PACKETSTORMid:150118date:2018-10-31T16:14:57
db:CNNVDid:CNNVD-201808-947date:2018-08-30T00:00:00
db:NVDid:CVE-2018-4268date:2019-04-03T18:29:04.220