CVE-2016-4655
MEDIUM KEV RANSOMWAREWebKit not_number defineProperties UAF
Title source: metasploitExploitation Summary
CVE-2016-4655 is actively exploited and listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, added May 24, 2022, with confirmed use in ransomware campaigns. EIP tracks 3 public exploits from researchers including Metasploit, jndok, Cryptiiiic.
AI-analyzed exploit summary This Metasploit module exploits a use-after-free (UAF) vulnerability in WebKit's JavaScriptCore library (CVE-2016-4657) to achieve remote code execution on iOS devices. It leverages memory corruption techniques to bypass mitigations and execute arbitrary payloads.
Description
The kernel in Apple iOS before 9.3.5 allows attackers to obtain sensitive information from memory via a crafted app.
Exploits (3)
This Metasploit module exploits a use-after-free (UAF) vulnerability in WebKit's JavaScriptCore library (CVE-2016-4657) to achieve remote code execution on iOS devices. It leverages memory corruption techniques to bypass mitigations and execute arbitrary payloads.
This repository contains a functional local privilege escalation (LPE) exploit for CVE-2016-4655 and CVE-2016-4656 on OS X 10.11.6. The exploit leverages kernel memory corruption via IOKit to achieve arbitrary code execution in kernel mode.
This repository contains a functional exploit for CVE-2016-4655, targeting iOS 8.4.1. The exploit leverages a kernel memory leak vulnerability in the IOKit framework to extract the kernel slide (kslide) value, which is a critical step in bypassing kernel address space layout randomization (KASLR).
References (10)
Scores
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N