CVE-2018-4304

Vulnerability

CVE-2018-4304 is a denial of service issue affecting Apple operating systems: iOS versions prior to 12, macOS Mojave prior to 10.14, tvOS prior to 12, and watchOS prior to 5. The vulnerability exists in a component that receives local app input; Apple addressed it by improving input validation to prevent malformed data from causing a denial of service [1][2][3][4].

Exploitation

A local app installed on the device can trigger the denial of service by sending specially crafted input to the vulnerable component. No network access or user interaction beyond running the app is required [1][2][3][4].

Impact

Successful exploitation allows the malicious app to crash the targeted system service or the entire device, leading to a temporary denial of service. The attack does not result in privilege escalation or data disclosure; the impact is confined to system availability [1][2][3][4].

Mitigation

Apple released the following fixed versions: iOS 12, macOS Mojave 10.14, tvOS 12, and watchOS 5, all on September 17, 2018 (or later for macOS updates in the Mojave line). Users should update to these or newer versions to remediate the issue [1][2][3][4].