Published: 08/06/2018 Updated: 17/07/2018

CVSS v2 Base Score: 9.3 | Impact Score: 10 | Exploitability Score: 8.6

CVSS v3 Base Score: 7.8 | Impact Score: 5.9 | Exploitability Score: 1.8

VMScore: 936

Vector: AV:N/AC:M/Au:N/C:C/I:C/A:C

An issue exists in certain Apple products. iOS prior to 11.4 is affected. macOS prior to 10.13.5 is affected. tvOS prior to 11.4 is affected. watchOS prior to 4.3.1 is affected. The issue involves the "Kernel" component. A buffer overflow in mptcp_usr_connectx allows malicious users to execute arbitrary code in a privileged context via a crafted app.

Vulnerable Product	Search on Vulmon	Subscribe to Product
apple mac os x
apple apple tv
apple watchos
apple iphone os

mptcp_usr_connectx is the handler for the connectx syscall for the AP_MULTIPATH socket family The logic of this function fails to correctly handle source and destination sockaddrs which aren't AF_INET or AF_INET6: // verify sa_len for AF_INET: if (dst->sa_family == AF_INET && dst->sa_len != sizeof(mpte->__mpte_dst_v4)) ...

Full Disclosure mailing list archives   By Date By Thread </form>    APPLE-SA-2018-7-23-2 Additional information for APPLE-SA-2018-06-01-1 macOS High Sierra 10135, Security Update 2018-0 ...

CVE-2018-4241: XNU kernel heap overflow due to bad bounds checking in MPTCP for iOS 11 - 11.3.1released by Ian Beer

multi_path - exploit for p0 issue 1558 (CVE-2018-4241) @i41nbeer mptcp_usr_connectx is the handler for the connectx syscall for the AP_MULTIPATH socket family The logic of this function fails to correctly handle source and destination sockaddrs which aren't AF_INET or AF_INET6: // verify sa_len for AF_INET: if (dst->sa_family == AF_INET &&

An incomplete iOS 11.2 -> iOS 11.3.1 Jailbreak

Osiris-Jailbreak ONLY FOR DEVELOPERS! An incomplete iOS 112 -> iOS 1131 Jailbreak by GeoSn0w (@FCE365) using multi_path (CVE-2018-4241) by Ian Beer and #QiLin by Jonathan Levin This jailbreak is under development and in no way whatsoever intended for general public usage Please don't run this jailbreak on your device until I finish it as it has the potentia

CWE-119 https://support.apple.com/HT208851 https://support.apple.com/HT208850 https://support.apple.com/HT208849 https://support.apple.com/HT208848 https://bugs.chromium.org/p/project-zero/issues/detail?id=1558 https://www.exploit-db.com/exploits/44849/http://www.securitytracker.com/id/1041027 https://nvd.nist.gov https://github.com/0neday/multi_path https://www.exploit-db.com/exploits/44849/

CVE-2018-4241

Vulnerability Summary

Vulnerability Trend

Exploits

Mailing Lists

Github Repositories

References

Vulmon Search

About

Products

Connect