Vulnerability Details : CVE-2014-4404
Public exploit exists!
Heap-based buffer overflow in IOHIDFamily in Apple iOS before 8 and Apple TV before 7 allows attackers to execute arbitrary code in a privileged context via an application that provides crafted key-mapping properties.
Vulnerability category: OverflowExecute code
Products affected by CVE-2014-4404
- cpe:2.3:o:apple:mac_os_x:*:*:*:*:*:*:*:*
- cpe:2.3:o:apple:mac_os_x:*:*:*:*:*:*:*:*
- cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:*
- cpe:2.3:o:apple:tvos:*:*:*:*:*:*:*:*
CVE-2014-4404 is in the CISA Known Exploited Vulnerabilities Catalog
CISA vulnerability name:
Apple OS X Heap-Based Buffer Overflow Vulnerability
CISA required action:
Apply updates per vendor instructions.
CISA description:
Heap-based buffer overflow in IOHIDFamily in Apple OS X, which affects, iOS before 8 and Apple TV before 7, allows attackers to execute arbitrary code in a privileged context.
Notes:
https://nvd.nist.gov/vuln/detail/CVE-2014-4404
Added on
2022-02-10
Action due date
2022-08-10
Exploit prediction scoring system (EPSS) score for CVE-2014-4404
53.36%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 98 %
Percentile, the proportion of vulnerabilities that are scored at or less
Metasploit modules for CVE-2014-4404
-
Mac OS X IOKit Keyboard Driver Root Privilege Escalation
Disclosure Date: 2014-09-24First seen: 2020-04-26exploit/osx/local/iokit_keyboard_rootA heap overflow in IOHIKeyboardMapper::parseKeyMapping allows kernel memory corruption in Mac OS X before 10.10. By abusing a bug in the IORegistry, kernel pointers can also be leaked, allowing a full kASLR bypass. Tested on Mavericks 10.9.5, and should work on prev
CVSS scores for CVE-2014-4404
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
|---|---|---|---|---|---|---|
|
9.3
|
HIGH | AV:N/AC:M/Au:N/C:C/I:C/A:C |
8.6
|
10.0
|
NIST | |
|
7.8
|
HIGH | CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H |
1.8
|
5.9
|
134c704f-9b21-4f2e-91b3-4a467353bcc0 | 2025-01-29 |
|
7.8
|
HIGH | CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H |
1.8
|
5.9
|
NIST | 2024-07-24 |
CWE ids for CVE-2014-4404
-
The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.Assigned by: nvd@nist.gov (Primary)
-
The product writes data past the end, or before the beginning, of the intended buffer.Assigned by:
- 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary)
- nvd@nist.gov (Primary)
References for CVE-2014-4404
-
http://archives.neohapsis.com/archives/bugtraq/2014-09/0106.html
Broken Link
-
http://www.securityfocus.com/bid/69947
Apple TV and iOS CVE-2014-4404 Heap Based Buffer Overflow VulnerabilityBroken Link;Third Party Advisory;VDB Entry
-
http://support.apple.com/kb/HT6441
About the security content of iOS 8 - Apple SupportVendor Advisory
-
http://archives.neohapsis.com/archives/bugtraq/2014-09/0107.html
Broken Link
-
http://support.apple.com/kb/HT6442
About the security content of Apple TV 7 - Apple SupportVendor Advisory
-
https://support.apple.com/kb/HT6535
About the security content of OS X Yosemite v10.10 - Apple SupportVendor Advisory
-
http://www.securitytracker.com/id/1030866
Apple iOS Multiple Bugs Let Remote Users Obtain Information and Execute Arbitrary Code andLocal Users Gain Elevated Privileges and Deny Service - SecurityTrackerBroken Link;Third Party Advisory;VDB Entry
-
https://support.apple.com/HT204659
About the security content of OS X Yosemite v10.10.3 and Security Update 2015-004 - Apple SupportVendor Advisory
-
http://www.securityfocus.com/bid/69882
RETIRED: Apple iOS Prior to iOS 8 and TV Prior to TV 7 Multiple VulnerabilitiesBroken Link;Third Party Advisory;VDB Entry
-
http://lists.apple.com/archives/security-announce/2015/Apr/msg00001.html
Apple - Lists.apple.comMailing List;Vendor Advisory
-
https://exchange.xforce.ibmcloud.com/vulnerabilities/96111
Apple iOS and Apple TV IOHIDFamily buffer overflow CVE-2014-4404 Vulnerability ReportThird Party Advisory;VDB Entry
-
http://archives.neohapsis.com/archives/bugtraq/2014-10/0101.html
Broken Link
Jump to