#VU15513 Out-of-bounds read in macOS - CVE-2018-4338

Vulnerability identifier: #VU15513

Vulnerability risk: Low

CVSSv4.0: 5.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/U:Clear]

CVE-ID: CVE-2018-4338

CWE-ID: CWE-125

Exploitation vector: Local

Exploit availability: No

Vulnerable software:
macOS
Operating systems & Components / Operating system

Vendor: Apple Inc.

Description
The vulnerability allows a local attacker to obtain potentially sensitive information on the target system.

The weakness exists on systems with Wi-Fi is enabled due to stack value by OOB Read is stored in the ol_nd_hostip variable when the setOFFLOAD_NDP function does not check the input value. A local attacker can use the dlsym function to /System/Library/PrivateFrameworks/Apple80211.framework/Apple80211, which yields Apple80211Open, Apple80211BindToInterface, and Apple80211Close functions, trigger out-of-bounds read and obtain a kernel address for privilege escalation in the Apple OS X local environment.

Mitigation
Update to version 10.14.

Vulnerable software versions

macOS: 10.13 17A365 - 10.13.6 17G66

---

External links
https://www.thezdi.com/blog/2018/10/24/cve-2018-4338-triggering-an-information-disclosure-on-macos-t...

---

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability. However, proof of concept for this vulnerability is available.