An iMessage vulnerability was discovered by Google Project
Zero security researcher was as of late fixed by Apple as a component of the
12.4 iOS update which enabled potential attackers to peruse contents of many
files put away on iOS devices remotely with no user interaction.
The security flaw tracked as CVE-2019-8646 was reported in
Apple during May. Natalie Silvanovich, the researcher who found the
vulnerability created the proof of concept works just on devices running iOS 12
or later and said that it is structured as "a simple example to
demonstrate the reach-ability of the class in Springboard. The actual
consequences of the bug are likely more serious."
Describing the issue in detail on Project Zero's bug tracker
she says:
“First, it could
potentially allow undesired access to local files if the code deserializing the
buffer ever shares it (this is more likely to cause problems in components that
use serialized objects to communicate locally than in iMessage). Second, it
allows an NSData object to be created with a length that is different than the
length of its byte array. This violates a very basic property that should
always be true of NSData objects. This can allow out of bounds reads, and could
also potentially lead to out-of-bounds writes, as it is now possible to create
NSData objects with very large sizes that would not be possible if the buffer
was backed.”
Later adding the Google security researcher says that ‘the
iMessage issue is caused by the _NSDataFileBackedFuture class which can be deserialized
even if secure encoding is enabled. This class is a file-backed NSData object
that loads a local file into memory when the [NSData bytes] selector is called.’
Apart from this Silvanovich discovered two other iMessage
vulnerabilities in collaboration with Google Project Zero's Samuel Groß, flaws
that additionally got fixed in the iOS 12.4 update.
The first is memory vulnerability in Core Data tracked as
CVE-2019-8660 fixed with improved length checking and the second, a Core Data
use after free issue tracked as CVE-2019-8647 that may enable a remote attacker
to cause arbitrary code execution on iPhone 5s or iPad's.
In general, five iMessage bugs were found by Silvanovich,
with the last two being an input validation issue which could block devices
with a contorted message, that was fixed in iOS 12.3 and released on May 13 and
an 'out-of-bounds read' read prompting a memory leak which was fixed in watch iOS
5.3 issued on July 22.
