Apple XNU CVE-2019-8605 Arbitray Code Execution Vulnerability

Bugtraq ID:	108481
Class:	Failure to Handle Exceptional Conditions
CVE:	CVE-2019-8605
Remote:	Yes
Local:	No
Published:	May 13 2019 12:00AM
Updated:	May 13 2019 12:00AM
Credit:	Ned Williamson working with Google Project Zero
Vulnerable:	Apple watchOS 5.1.3 Apple watchOS 5.1.2 Apple watchOS 2.0.1 Apple watchOS 1.0.1 Apple watchOS 5 Apple watchOS 2.0 Apple watchOS 1.0 Apple Watch Hermes 0 Apple Watch Edition 0 Apple Watch 0 Apple tvOS 12.2.1 Apple tvOS 12.1.2 Apple tvOS 12.1.1 Apple tvOS 11.4.1 Apple tvOS 11.2.6 Apple tvOS 11.2.5 Apple tvOS 10.1.1 Apple tvOS 10.0.1 Apple tvOS 9.2.2 Apple tvOS 9.2.1 Apple tvOS 9.1.1 Apple tvOS 9.2 Apple tvOS 9.1 Apple tvOS 9.0 Apple tvOS 12 Apple tvOS 11.4 Apple tvOS 11.2.1 Apple tvOS 11.2 Apple tvOS 11.1 Apple tvOS 11 Apple tvOS 10.2.2 Apple tvOS 10.2.1 Apple tvOS 10.2 Apple tvOS 10.1 Apple tvOS 10 Apple TV 0 Apple macOS 10.14.4 Apple macOS 10.13.6 Apple macOS 10.12.6 Apple iPod Touch 0 Apple iPhone 0 Apple iPad 0 Apple iOS 5 0 Apple iOS 4 0 Apple iOS 3 0 Apple iOS 12.1.4 Apple iOS 12.1.3 Apple iOS 12.1.1 Apple iOS 12.0.1 Apple iOS 11.4.1 Apple iOS 10.2.1 Apple iOS 10.0.1 Apple iOS 9.0.2 Apple iOS 9.0.1 Apple iOS 8.4.1 Apple iOS 7.2 Apple iOS 7.0.6 Apple iOS 7.0.5 Apple iOS 7.0.3 Apple iOS 7.0.2 Apple iOS 7.0.1 Apple iOS 6.3.1 Apple iOS 6.1.6 Apple iOS 6.1.4 Apple iOS 6.1.3 Apple iOS 4.2.1 Apple iOS 4.0.2 Apple iOS 4.0.1 Apple iOS 3.2.2 Apple iOS 3.2.1 Apple iOS 9.1 Apple iOS 9 Apple iOS 8.4 Apple iOS 8.3 Apple iOS 8.2 Apple iOS 8.1.3 Apple iOS 8.1.2 Apple iOS 8.1.1 Apple iOS 8.1 Apple iOS 8 Apple iOS 7.1.2 Apple iOS 7.1.1 Apple iOS 7.1 Apple iOS 7.0.4 Apple iOS 7 Apple iOS 6.1 Apple iOS 6.0.2 Apple iOS 6.0.1 Apple iOS 6 Apple iOS 5.1.1 Apple iOS 5.1 Apple iOS 5.0.1 Apple iOS 5 Apple iOS 4.3.5 Apple iOS 4.3.4 Apple iOS 4.3.3 Apple iOS 4.3.2 Apple iOS 4.3.1 Apple iOS 4.3 Apple iOS 4.2.9 Apple iOS 4.2.8 Apple iOS 4.2.7 Apple iOS 4.2.6 Apple iOS 4.2.5 Apple iOS 4.2.10 Apple iOS 4.2 Apple iOS 4.1 Apple iOS 4 Apple iOS 3.2 Apple iOS 3.1 Apple iOS 3.0 Apple iOS 2.1 Apple iOS 2.0 Apple iOS 12.2 Apple iOS 12.1 Apple iOS 12 Apple iOS 11.4 Apple iOS 11.3.1 Apple iOS 11.3 Apple iOS 11.2.6 Apple iOS 11.2.5 Apple iOS 11.2.2 Apple iOS 11.2.1 Apple iOS 11.2 Apple iOS 11.1 Apple iOS 11 Apple iOS 10.3.3 Apple iOS 10.3.2 Apple iOS 10.3.1 Apple iOS 10.3 Apple iOS 10.2 Apple iOS 10.1 Apple iOS 10
Not Vulnerable:	Apple watchOS 5.2.1 Apple tvOS 12.3 Apple macOS 10.14.5 Apple macOS Security Update 2019 Apple macOS Security Update 2019 Apple iOS 12.3

Apple XNU CVE-2019-8605 Arbitray Code Execution Vulnerability

Apple XNU is prone to an arbitrary code-execution vulnerability

An attacker can leverage this issue to execute arbitrary code within the context of the affected system. Failed exploit attempts will likely result in denial-of-service conditions.

Apple XNU CVE-2019-8605 Arbitray Code Execution Vulnerability

Solution:
Updates are available. Please see the references or vendor advisory for more information.

Apple XNU CVE-2019-8605 Arbitray Code Execution Vulnerability

References:

• Apple Home Page (Apple)
  
• Apple iOS Homepage (Apple)
  
• Apple watchOS Homepage (Apple)
  
• About the security content of iOS 12.3 (Apple)
  
• About the security content of macOS Mojave 10.14.5, Security Update 2019-003 Hig (Apple)
  
• About the security content of tvOS 12.3 (Apple)
  
• About the security content of watchOS 5.2.1 (Apple)
  
• Issue 1806: XNU: Use-after-free due to stale pointer left by in6_pcbdetach (Chromium)