Exploitation Summary
EIP tracks 2 public exploits for CVE-2019-8591. PoCs published by Google Security Research, jsherman212.
AI-analyzed exploit summary This PoC exploits a type confusion vulnerability in macOS's stf_ioctl function, where a user-provided `struct ifreq` is incorrectly cast to `struct ifaddr`, leading to a kernel panic. The exploit triggers a page fault by accessing invalid memory, demonstrating the vulnerability in macOS 10.14.3.
Description
A type confusion issue was addressed with improved memory handling. This issue is fixed in iOS 12.3, macOS Mojave 10.14.5, tvOS 12.3, watchOS 5.2.1. An application may be able to cause unexpected system termination or write kernel memory.
Exploits (2)
This PoC exploits a type confusion vulnerability in macOS's stf_ioctl function, where a user-provided `struct ifreq` is incorrectly cast to `struct ifaddr`, leading to a kernel panic. The exploit triggers a page fault by accessing invalid memory, demonstrating the vulnerability in macOS 10.14.3.
This is a kernel exploit for iOS 12-12.2 and 12.4, leveraging a use-after-free vulnerability (CVE-2019-8591) to achieve local privilege escalation. The exploit manipulates kernel structures to gain arbitrary read/write capabilities.
References (4)
Scores
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H