Exploitation Summary
EIP tracks 3 public exploits for CVE-2018-4441. PoCs published by Google Security Research, Specter, Cryptogenic.
AI-analyzed exploit summary This PoC exploits a vulnerability in JavaScriptCore's array handling, specifically manipulating `m_numValuesInVector` to bypass hole checks, leading to out-of-bounds (OOB) reads/writes. The exploit leverages `Array.prototype.splice` to trigger the vulnerability by setting an unusually large array length and then manipulating it.
Description
A memory corruption issue was addressed with improved memory handling. This issue affected versions prior to iOS 12.1.1, tvOS 12.1.1, watchOS 5.1.2, Safari 12.0.2, iTunes 12.9.2 for Windows, iCloud for Windows 7.9.
Exploits (3)
This PoC exploits a vulnerability in JavaScriptCore's array handling, specifically manipulating `m_numValuesInVector` to bypass hole checks, leading to out-of-bounds (OOB) reads/writes. The exploit leverages `Array.prototype.splice` to trigger the vulnerability by setting an unusually large array length and then manipulating it.
This is a working proof-of-concept exploit for CVE-2018-4441, targeting the PlayStation 4 WebKit on firmware 6.20. It achieves arbitrary read/write primitives and ROP chain execution, demonstrating userland code execution via syscalls like `sys_getpid()` and `sys_getuid()`.
This is a working proof-of-concept exploit for CVE-2018-4441, targeting the PlayStation 4 WebKit on firmware 6.20. It leverages a JavaScriptCore vulnerability to achieve arbitrary read/write primitives and code execution via ROP chains.
References (6)
Scores
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H