CVE-2019-8605
Published: 18 December 2019
Summary
CVE-2019-8605 is a high-severity Use After Free (CWE-416) vulnerability in Apple Iphone Os. Its CVSS base score is 7.8 (High).
Operationally, ranked in the top 5.6% of CVEs by exploit likelihood; CISA has added it to the Known Exploited Vulnerabilities catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-16 (Memory Protection) and SI-2 (Flaw Remediation).
Deeper analysis
A use-after-free vulnerability, identified as CVE-2019-8605 and assigned CWE-416, was present in Apple platforms prior to the listed updates. The flaw stems from insufficient memory management and affects iOS before 12.3, macOS Mojave before 10.14.5, tvOS before 12.3, and watchOS before 5.2.1, with a CVSS 3.1 base score of 7.8 under the vector AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H.
A local attacker who can run a malicious application on an affected device may exploit the issue to achieve arbitrary code execution with system privileges. No elevated privileges are required, though user interaction is needed to trigger the vulnerable code path.
Apple security advisories corresponding to the referenced support pages (HT210118, HT210119, HT210120, and HT210122) state that the vulnerability is resolved by the improved memory management in the listed platform releases and advise installing those updates. No further details on real-world exploitation or additional mitigations are provided in the available references.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2019-17995
Vulnerability details
A use after free issue was addressed with improved memory management. This issue is fixed in iOS 12.3, macOS Mojave 10.14.5, tvOS 12.3, watchOS 5.2.1. A malicious application may be able to execute arbitrary code with system privileges.
- CWE(s)
- KEV Date Added
- 27 June 2022
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly requires memory protection mechanisms that would have prevented exploitation of the use-after-free flaw.
Mandates timely application of patches that remediate the insufficient memory-management defect.
Enforces process isolation boundaries that limit the ability of a malicious app to corrupt or reuse freed memory across processes.