Sign-up

ID

VAR-202002-1165


CVE

CVE-2020-3839


TITLE

macOS Catalina Input validation vulnerabilities in

Trust: 0.8

sources: JVNDB: JVNDB-2020-002327

DESCRIPTION

A validation issue was addressed with improved input sanitization. This issue is fixed in macOS Catalina 10.15.3. An application may be able to read restricted memory. This vulnerability allows local attackers to disclose sensitive information on affected installations of Apple macOS. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.The specific flaw exists within the IO80211Family kernel extension. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this in conjunction with other vulnerabilities to escalate privileges in the context of the kernel. Apple macOS Catalina is a set of dedicated operating systems developed by Apple for Mac computers. A security vulnerability exists in the Wi-Fi component of Apple macOS Catalina versions prior to 10.15.3. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 APPLE-SA-2020-1-28-2 macOS Catalina 10.15.3, Security Update 2020-001 Mojave, Security Update 2020-001 High Sierra macOS Catalina 10.15.3, Security Update 2020-001 Mojave, and Security Update 2020-001 High Sierra are now available and address the following: AnnotationKit Available for: macOS Catalina 10.15.2 Impact: A remote attacker may be able to cause unexpected application termination or arbitrary code execution Description: An out-of-bounds read was addressed with improved input validation. CVE-2020-3877: an anonymous researcher working with Trend Micro's Zero Day Initiative apache_mod_php Available for: macOS High Sierra 10.13.6, macOS Mojave 10.14.6, macOS Catalina 10.15.2 Impact: Multiple issues in PHP Description: Multiple issues were addressed by updating to PHP version 7.3.11. CVE-2019-11043 Audio Available for: macOS Catalina 10.15.2 Impact: An application may be able to execute arbitrary code with system privileges Description: A memory corruption issue was addressed with improved memory handling. CVE-2020-3857: Zhuo Liang of Qihoo 360 Vulcan Team autofs Available for: macOS Catalina 10.15.2 Impact: Searching for and opening a file from an attacker controlled NFS mount may bypass Gatekeeper Description: This was addressed with additional checks by Gatekeeper on files mounted through a network share. CVE-2020-3866: Jose Castro Almeida (@HackerOn2Wheels) and René Kroka (@rene_kroka) CoreBluetooth Available for: macOS High Sierra 10.13.6, macOS Mojave 10.14.6 Impact: A remote attacker may be able to cause unexpected application termination or arbitrary code execution Description: A memory corruption issue was addressed with improved input validation. CVE-2020-3848: Jianjun Dai of Qihoo 360 Alpha Lab CVE-2020-3849: Jianjun Dai of Qihoo 360 Alpha Lab CVE-2020-3850: Jianjun Dai of Qihoo 360 Alpha Lab CoreBluetooth Available for: macOS High Sierra 10.13.6, macOS Mojave 10.14.6 Impact: A remote attacker may be able to leak memory Description: An out-of-bounds read was addressed with improved input validation. CVE-2020-3847: Jianjun Dai of Qihoo 360 Alpha Lab Crash Reporter Available for: macOS High Sierra 10.13.6, macOS Mojave 10.14.6, macOS Catalina 10.15.2 Impact: A malicious application may be able to access restricted files Description: A validation issue existed in the handling of symlinks. CVE-2020-3835: Csaba Fitzl (@theevilbit) Image Processing Available for: macOS High Sierra 10.13.6, macOS Mojave 10.14.6, macOS Catalina 10.15.2 Impact: Viewing a maliciously crafted JPEG file may lead to arbitrary code execution Description: A memory corruption issue was addressed with improved input validation. CVE-2020-3827: Samuel Groß of Google Project Zero ImageIO Available for: macOS High Sierra 10.13.6, macOS Mojave 10.14.6, macOS Catalina 10.15.2 Impact: Processing a maliciously crafted image may lead to arbitrary code execution Description: An out-of-bounds read was addressed with improved input validation. CVE-2020-3826: Samuel Groß of Google Project Zero CVE-2020-3870 CVE-2020-3878: Samuel Groß of Google Project Zero Intel Graphics Driver Available for: macOS Mojave 10.14.6, macOS Catalina 10.15.2 Impact: An application may be able to execute arbitrary code with system privileges Description: A memory corruption issue was addressed with improved memory handling. CVE-2020-3845: Zhuo Liang of Qihoo 360 Vulcan Team IOAcceleratorFamily Available for: macOS Catalina 10.15.2 Impact: An application may be able to execute arbitrary code with kernel privileges Description: A memory corruption issue was addressed with improved memory handling. CVE-2020-3837: Brandon Azad of Google Project Zero IPSec Available for: macOS Catalina 10.15.2 Impact: Loading a maliciously crafted racoon configuration file may lead to arbitrary code execution Description: An off by one issue existed in the handling of racoon configuration files. CVE-2020-3875: Brandon Azad of Google Project Zero Kernel Available for: macOS Catalina 10.15.2 Impact: An application may be able to read restricted memory Description: A memory initialization issue was addressed with improved memory handling. CVE-2020-3872: Haakon Garseg Mørk of Cognite and Cim Stordal of Cognite Kernel Available for: macOS High Sierra 10.13.6, macOS Mojave 10.14.6, macOS Catalina 10.15.2 Impact: A malicious application may be able to execute arbitrary code with system privileges Description: A type confusion issue was addressed with improved memory handling. CVE-2020-3853: Brandon Azad of Google Project Zero Kernel Available for: macOS High Sierra 10.13.6, macOS Mojave 10.14.6, macOS Catalina 10.15.2 Impact: A malicious application may be able to determine kernel memory layout Description: An access issue was addressed with improved memory management. CVE-2020-3836: Brandon Azad of Google Project Zero Kernel Available for: macOS High Sierra 10.13.6, macOS Mojave 10.14.6, macOS Catalina 10.15.2 Impact: An application may be able to execute arbitrary code with kernel privileges Description: A memory corruption issue was addressed with improved memory handling. CVE-2020-3842: Ned Williamson working with Google Project Zero CVE-2020-3871: Corellium libxml2 Available for: macOS High Sierra 10.13.6, macOS Mojave 10.14.6 Impact: Processing maliciously crafted XML may lead to an unexpected application termination or arbitrary code execution Description: A buffer overflow was addressed with improved size validation. CVE-2020-3846: Ranier Vilela libxpc Available for: macOS High Sierra 10.13.6, macOS Mojave 10.14.6, macOS Catalina 10.15.2 Impact: Processing a maliciously crafted string may lead to heap corruption Description: A memory corruption issue was addressed with improved input validation. CVE-2020-3856: Ian Beer of Google Project Zero libxpc Available for: macOS High Sierra 10.13.6, macOS Mojave 10.14.6, macOS Catalina 10.15.2 Impact: An application may be able to gain elevated privileges Description: An out-of-bounds read was addressed with improved bounds checking. CVE-2020-3829: Ian Beer of Google Project Zero PackageKit Available for: macOS High Sierra 10.13.6, macOS Mojave 10.14.6, macOS Catalina 10.15.2 Impact: A malicious application may be able to overwrite arbitrary files Description: A validation issue existed in the handling of symlinks. CVE-2020-3830: Csaba Fitzl (@theevilbit) Security Available for: macOS Catalina 10.15.2 Impact: An application may be able to execute arbitrary code with system privileges Description: A memory corruption issue was addressed with improved memory handling. CVE-2020-3854: Jakob Rieck (@0xdead10cc) and Maximilian Blochberger of the Security in Distributed Systems Group of University of Hamburg sudo Available for: macOS High Sierra 10.13.6, macOS Mojave 10.14.6, macOS Catalina 10.15.2 Impact: Certain configurations may allow a local attacker to execute arbitrary code Description: A buffer overflow issue was addressed with improved memory handling. CVE-2019-18634: Apple System Available for: macOS High Sierra 10.13.6, macOS Mojave 10.14.6 Impact: A malicious application may be able to overwrite arbitrary files Description: An access issue was addressed with improved access restrictions. CVE-2020-3839: s0ngsari of Theori and Lee of Seoul National University working with Trend Micro's Zero Day Initiative Wi-Fi Available for: macOS High Sierra 10.13.6, macOS Mojave 10.14.6, macOS Catalina 10.15.2 Impact: A remote attacker may be able to cause unexpected system termination or corrupt kernel memory Description: A memory corruption issue was addressed with improved input validation. CVE-2020-3843: Ian Beer of Google Project Zero wifivelocityd Available for: macOS High Sierra 10.13.6, macOS Mojave 10.14.6, macOS Catalina 10.15.2 Impact: An application may be able to execute arbitrary code with system privileges Description: The issue was addressed with improved permissions logic. CVE-2020-3838: Dayton Pidhirney (@_watbulb) Additional recognition Photos Storage We would like to acknowledge Salman Husain of UC Berkeley for their assistance. Installation note: macOS Catalina 10.15.3, Security Update 2020-001 Mojave, and Security Update 2020-001 High Sierra may be obtained from the Mac App Store or Apple's Software Downloads web site: https://support.apple.com/downloads/ Information will also be posted to the Apple Security Updates web site: https://support.apple.com/kb/HT201222 This message is signed with Apple's Product Security PGP key, and details are available at: https://www.apple.com/support/security/pgp/ -----BEGIN PGP SIGNATURE----- iQIzBAEBCAAdFiEEM5FaaFRjww9EJgvRBz4uGe3y0M0FAl4wsjUACgkQBz4uGe3y 0M1CeQ//ZJ/ZlrPF1P8nFvUy5XnOEgSt5U3W3klWT1x7B7s5NOQQkh+Iw02+dkYZ hErXRA1Awvzw4SpOOoG1HiElt2qz1+N8NaKgg4+Evk1CPB3KaX9g8l+PBFSKyVqU GQUSlsPB2GXky92moq0TtFO9VCwsPbQfj/618RzUn/CSF5ifNI+fMdWAfrndZSRv yg6XndljJx7Ro1OeQI794Aa1KdxdErbqnai+i++gGAiKG8zg89HLxhwaEje0u59M 35iAp9HAksZwOD/YOWkhiksXjS/89qtyt2z3yrpSUh8s1f86NumMre6D2C9kwY1c 8XlaCN/KE8BGMXzg+daMibpeaIoweeObfw6tT8QlF2OtxKtnvm55C1nIIYKlVqen GS11EkWweC9ZAEepVaBML95JEmaSin13oTvRg2s+DaiLE/RsRxz09qLqdyj1sbdf 2Gyl9xnTPjcDuhvbaGZl/uIEHIkgpLnNrs3bVkUOQwJZU8hpFcE1jwgGwNo8Nkwz TCAi0s4+q7csgZuTOlHroXTteFm+UQcV4Sw7YCZ2Z3kNDkEJpDDf8PEWGrGyJa8p iZJ4FqP0D9pv0N161V6f6xZ6QZW379tZfAeEHeoIE6lAfDN7BnENsuph10dvK9IT 1HlUvSj57BkM6b4BcoT9WjyFIWNp3T7ySJ+K15PHXx707SX1R9w= =toYN -----END PGP SIGNATURE-----=

Trust: 2.43

sources: NVD: CVE-2020-3839 // JVNDB: JVNDB-2020-002327 // ZDI: ZDI-20-215 // VULHUB: VHN-181964 // PACKETSTORM: 156131

AFFECTED PRODUCTS

vendor:applemodel:mac os xscope:ltversion:10.15.3

Trust: 1.0

vendor:applemodel:mac os xscope:eqversion:10.15.2

Trust: 0.8

vendor:applemodel:macosscope: - version: -

Trust: 0.7

vendor:applemodel:mac os xscope:eqversion:10.15.1

Trust: 0.6

vendor:applemodel:mac os xscope:eqversion:10.14.4

Trust: 0.6

vendor:applemodel:mac os xscope:eqversion:10.5.8

Trust: 0.6

vendor:applemodel:mac os xscope:eqversion:10.5.7

Trust: 0.6

vendor:applemodel:mac os xscope:eqversion:10.14.1

Trust: 0.6

vendor:applemodel:mac os xscope:eqversion:10.15

Trust: 0.6

vendor:applemodel:mac os xscope:eqversion:10.14.6

Trust: 0.6

vendor:applemodel:mac os xscope:eqversion:10.14.5

Trust: 0.6

vendor:applemodel:mac os xscope:eqversion:10.14.2

Trust: 0.6

vendor:applemodel:mac os xscope:eqversion:10.6.0

Trust: 0.6

sources: ZDI: ZDI-20-215 // JVNDB: JVNDB-2020-002327 // CNNVD: CNNVD-202001-1418 // NVD: CVE-2020-3839

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2020-3839
value: MEDIUM

Trust: 1.0

NVD: JVNDB-2020-002327
value: MEDIUM

Trust: 0.8

ZDI: CVE-2020-3839
value: HIGH

Trust: 0.7

CNNVD: CNNVD-202001-1418
value: MEDIUM

Trust: 0.6

VULHUB: VHN-181964
value: LOW

Trust: 0.1

nvd@nist.gov: CVE-2020-3839
severity: LOW
baseScore: 2.1
vectorString: AV:L/AC:L/AU:N/C:P/I:N/A:N
accessVector: LOCAL
accessComplexity: LOW
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: NONE
availabilityImpact: NONE
exploitabilityScore: 3.9
impactScore: 2.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.0

NVD: JVNDB-2020-002327
severity: LOW
baseScore: 2.1
vectorString: AV:L/AC:L/AU:N/C:P/I:N/A:N
accessVector: LOCAL
accessComplexity: LOW
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: NONE
availabilityImpact: NONE
exploitabilityScore: NONE
impactScore: NONE
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.8

VULHUB: VHN-181964
severity: LOW
baseScore: 2.1
vectorString: AV:L/AC:L/AU:N/C:P/I:N/A:N
accessVector: LOCAL
accessComplexity: LOW
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: NONE
availabilityImpact: NONE
exploitabilityScore: 3.9
impactScore: 2.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.1

nvd@nist.gov: CVE-2020-3839
baseSeverity: MEDIUM
baseScore: 5.5
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
attackVector: LOCAL
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: NONE
availabilityImpact: NONE
exploitabilityScore: 1.8
impactScore: 3.6
version: 3.1

Trust: 1.0

NVD: JVNDB-2020-002327
baseSeverity: MEDIUM
baseScore: 5.5
vectorString: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
attackVector: LOCAL
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: NONE
availabilityImpact: NONE
exploitabilityScore: NONE
impactScore: NONE
version: 3.0

Trust: 0.8

ZDI: CVE-2020-3839
baseSeverity: HIGH
baseScore: 7.1
vectorString: AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
attackVector: LOCAL
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: CHANGED
confidentialityImpact: HIGH
integrityImpact: NONE
availabilityImpact: NONE
exploitabilityScore: 2.5
impactScore: 4.0
version: 3.0

Trust: 0.7

sources: ZDI: ZDI-20-215 // VULHUB: VHN-181964 // JVNDB: JVNDB-2020-002327 // CNNVD: CNNVD-202001-1418 // NVD: CVE-2020-3839

PROBLEMTYPE DATA

problemtype:CWE-20

Trust: 1.9

sources: VULHUB: VHN-181964 // JVNDB: JVNDB-2020-002327 // NVD: CVE-2020-3839

THREAT TYPE

local

Trust: 0.6

sources: CNNVD: CNNVD-202001-1418

TYPE

input validation error

Trust: 0.6

sources: CNNVD: CNNVD-202001-1418

CONFIGURATIONS

sources:
            
            
            JVNDB: JVNDB-2020-002327

PATCH
title:HT210919url:https://support.apple.com/en-us/HT210919
Trust: 1.5
title:HT210919url:https://support.apple.com/ja-jp/HT210919
Trust: 0.8
title:Apple macOS Catalina Wi-Fi Fixes for component input validation error vulnerabilitiesurl:http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=110875
Trust: 0.6
sources:
            
            
            ZDI: ZDI-20-215 // 
            
            
            
            JVNDB: JVNDB-2020-002327 // 
            
            
            
            CNNVD: CNNVD-202001-1418

EXTERNAL IDS
db:NVDid:CVE-2020-3839
Trust: 3.3
db:ZDIid:ZDI-20-215
Trust: 1.3
db:JVNid:JVNVU95678717
Trust: 0.8
db:JVNDBid:JVNDB-2020-002327
Trust: 0.8
db:ZDI_CANid:ZDI-CAN-9595
Trust: 0.7
db:CNNVDid:CNNVD-202001-1418
Trust: 0.7
db:PACKETSTORMid:156131
Trust: 0.7
db:AUSCERTid:ESB-2020.0351
Trust: 0.6
db:VULHUBid:VHN-181964
Trust: 0.1
sources:
            
            
            ZDI: ZDI-20-215 // 
            
            
            
            VULHUB: VHN-181964 // 
            
            
            
            JVNDB: JVNDB-2020-002327 // 
            
            
            
            PACKETSTORM: 156131 // 
            
            
            
            CNNVD: CNNVD-202001-1418 // 
            
            
            
            NVD: CVE-2020-3839

REFERENCES
url:https://support.apple.com/ht210919
Trust: 1.7
url:https://nvd.nist.gov/vuln/detail/cve-2020-3839
Trust: 1.5
url:https://support.apple.com/en-us/ht210919
Trust: 1.3
url:https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2020-3839
Trust: 0.8
url:https://jvn.jp/vu/jvnvu95678717/
Trust: 0.8
url:https://vigilance.fr/vulnerability/apple-macos-multiple-vulnerabilities-31449
Trust: 0.6
url:https://packetstormsecurity.com/files/156131/apple-security-advisory-2020-1-28-2.html
Trust: 0.6
url:https://www.auscert.org.au/bulletins/esb-2020.0351/
Trust: 0.6
url:https://www.zerodayinitiative.com/advisories/zdi-20-215/
Trust: 0.6
url:https://nvd.nist.gov/vuln/detail/cve-2020-3826
Trust: 0.1
url:https://support.apple.com/kb/ht201222
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2020-3849
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2019-11043
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2020-3846
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2020-3835
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2020-3842
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2020-3837
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2020-3845
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2020-3870
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2020-3827
Trust: 0.1
url:https://support.apple.com/downloads/
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2020-3848
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2020-3856
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2019-18634
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2020-3866
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2020-3857
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2020-3840
Trust: 0.1
url:https://www.apple.com/support/security/pgp/
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2020-3871
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2020-3855
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2020-3850
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2020-3854
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2020-3853
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2020-3843
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2020-3847
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2020-3838
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2020-3830
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2020-3836
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2020-3829
Trust: 0.1
sources:
            
            
            ZDI: ZDI-20-215 // 
            
            
            
            VULHUB: VHN-181964 // 
            
            
            
            JVNDB: JVNDB-2020-002327 // 
            
            
            
            PACKETSTORM: 156131 // 
            
            
            
            CNNVD: CNNVD-202001-1418 // 
            
            
            
            NVD: CVE-2020-3839

CREDITS
s0ngsari @ Theori, Lee @ Seoul National University
Trust: 0.7
sources:
            
            
            ZDI: ZDI-20-215

SOURCES
db:ZDIid:ZDI-20-215
db:VULHUBid:VHN-181964
db:JVNDBid:JVNDB-2020-002327
db:PACKETSTORMid:156131
db:CNNVDid:CNNVD-202001-1418
db:NVDid:CVE-2020-3839

LAST UPDATE DATE
2024-11-23T19:59:05.662000+00:00

SOURCES UPDATE DATE
db:ZDIid:ZDI-20-215date:2020-02-11T00:00:00
db:VULHUBid:VHN-181964date:2020-03-02T00:00:00
db:JVNDBid:JVNDB-2020-002327date:2020-03-12T00:00:00
db:CNNVDid:CNNVD-202001-1418date:2020-03-09T00:00:00
db:NVDid:CVE-2020-3839date:2024-11-21T05:31:49.107

SOURCES RELEASE DATE
db:ZDIid:ZDI-20-215date:2020-02-11T00:00:00
db:VULHUBid:VHN-181964date:2020-02-27T00:00:00
db:JVNDBid:JVNDB-2020-002327date:2020-03-12T00:00:00
db:PACKETSTORMid:156131date:2020-01-29T17:17:36
db:CNNVDid:CNNVD-202001-1418date:2020-01-30T00:00:00
db:NVDid:CVE-2020-3839date:2020-02-27T21:15:16.773