CVE-2018-4167: apple iphone_os Race Condition

Vulnerability summary

CVE-2018-4167 is a high (CVSS 7.6) Race Condition vulnerability in apple iphone_os. EPSS estimates a 1.11% chance of exploitation in the next 30 days, higher than 65.5% of scored vulnerabilities.

Timeline

1. 03-04-2018
   PublishedVulnerability first disclosed.
2. 05-08-2024
   Last modifiedVulnerability information updated.

Description

An issue was discovered in certain Apple products. iOS before 11.3 is affected. macOS before 10.13.4 is affected. tvOS before 11.3 is affected. watchOS before 4.3 is affected. The issue involves the "File System Events" component. A race condition allows attackers to execute arbitrary code in a privileged context via a crafted app.

• CWE-362Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')The product contains a concurrent code sequence that requires temporary, exclusive access to a shared resource, but a timing window exists in which the shared resource can be modified by another code sequence operating concurrently.