CVE-2019-9536

MEDIUM

Apple iPhone 3GS - Improper Handling of Exceptional Conditions in Bootrom Malloc

Title source: llm
STIX 2.1

Description

Apple iPhone 3GS bootrom malloc implementation returns a non-NULL pointer when unable to allocate memory, aka 'alloc8'. An attacker with physical access to the device can install arbitrary firmware.

References (2)

Core 2
Core References
Exploit, Third Party Advisory x_refsource_misc
https://github.com/axi0mX/alloc8

Scores

CVSS v3 6.1
EPSS 0.0049
EPSS Percentile 37.9%
Attack Vector PHYSICAL
CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Details

CWE
CWE-755
Status published
Products (1)
apple/iphone_3gs
Published Nov 22, 2019
Tracked Since Feb 18, 2026