CVE-2016-4655
Apple iOS Information Disclosure Vulnerability
Description
CVE-2016-4655 is a kernel information disclosure vulnerability in Apple iOS that allows attackers to obtain sensitive information from kernel memory via a crafted application. This vulnerability was discovered as part of the Pegasus spyware chain developed by the NSO Group, where it was used alongside CVE-2016-4656 and CVE-2016-4657 to achieve a complete remote jailbreak of iOS devices. By leaking kernel memory layout information, CVE-2016-4655 enables attackers to bypass kernel address space layout randomization (KASLR), a critical prerequisite for reliable kernel exploitation. CISA has added this vulnerability to its KEV catalog, and the EPSS percentile of 99.2% indicates near-certain exploitation activity.
KEV Information
CVSS Score
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:NOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| apple | iphone os | < 9.3.5; 10.0 |
Multiple CVSS Assessments
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
References
- http://lists.apple.com/archives/security-announce/2016/Aug/msg00000.html(Broken Link, Mailing List, Vendor Advisory)
- http://lists.apple.com/archives/security-announce/2016/Sep/msg00005.html(Broken Link, Mailing List, Vendor Advisory)
- http://www.securityfocus.com/bid/92651(Broken Link, Third Party Advisory, VDB Entry)
- http://www.securityfocus.com/bid/92965(Broken Link, Third Party Advisory, VDB Entry)
- http://www.securitytracker.com/id/1036694(Broken Link, Third Party Advisory, VDB Entry)
- https://blog.lookout.com/blog/2016/08/25/trident-pegasus/(Broken Link)
- https://support.apple.com/HT207107(Vendor Advisory)
- https://support.apple.com/HT207145(Vendor Advisory)
- https://www.exploit-db.com/exploits/44836/(Exploit, Third Party Advisory, VDB Entry)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2016-4655(US Government Resource)
Weakness Type
CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
CWE-200 describes a weakness where a product exposes sensitive information to unauthorized actors. In CVE-2016-4655, the Apple iOS kernel fails to properly validate certain memory access operations, allowing a crafted application to read kernel memory contents and extract sensitive information including kernel base addresses needed to defeat KASLR protections.
Learn more: CWE-200 — Exposure of Sensitive Information to an Unauthorized Actor
Impact Analysis
CVE-2016-4655 is a critical enabler in one of the most sophisticated mobile exploit chains ever discovered. The vulnerability allows a locally executed application to leak kernel memory addresses, defeating Apple's KASLR protection. While the direct impact is limited to confidentiality through information disclosure, the leaked kernel base address is essential for reliable exploitation of kernel code execution vulnerabilities such as CVE-2016-4656. Together with CVE-2016-4657 (WebKit remote code execution) and CVE-2016-4656 (kernel privilege escalation), this vulnerability formed the Trident exploit chain used by NSO Group's Pegasus spyware to remotely jailbreak target iPhones via a single malicious link. The EPSS percentile of 99.2% reflects near-certain exploitation, and CISA has confirmed active exploitation in the KEV catalog.
Exploit Maturity
CVE-2016-4655 was exploited as a zero-day vulnerability as part of the Pegasus/Trident exploit chain discovered in August 2016. CISA has confirmed active exploitation and added it to the Known Exploited Vulnerabilities catalog with a remediation deadline of June 14, 2022. The EPSS percentile of 99.2% indicates near-certain exploitation probability. The exploit chain was developed by the NSO Group and sold as part of their Pegasus commercial spyware platform, targeting journalists, activists, and political figures. When combined with CVE-2016-4657 (WebKit memory corruption for initial code execution) and CVE-2016-4656 (kernel memory corruption for privilege escalation), CVE-2016-4655 provided the KASLR bypass necessary to make the kernel exploit reliable across different device configurations.
Remediation
- Update Apple iOS to version 9.3.5 or later, which patches CVE-2016-4655 along with the other Trident/Pegasus vulnerabilities. Apply updates per vendor instructions as required by CISA's KEV catalog.
- Enable automatic updates on all iOS devices to ensure timely deployment of future security patches that address kernel vulnerabilities.
- Avoid clicking links from unknown or untrusted sources, as the Pegasus exploit chain was delivered via malicious links in SMS messages and messaging applications.
- Deploy mobile device management (MDM) solutions to enforce update compliance and monitor for jailbreak indicators that may suggest exploitation of kernel vulnerabilities.
- For organizations at high risk of targeted surveillance, consider using Apple's Lockdown Mode (available in newer iOS versions) to reduce the attack surface for sophisticated exploit chains.
Technical Details
CVE-2016-4655 targets the Apple iOS kernel's memory management subsystem. The vulnerability allows an application to trigger a kernel code path that improperly returns kernel memory contents to user space, classified under CWE-200 (Exposure of Sensitive Information). Specifically, the attacker can extract the kernel slide value, which is the random offset applied to the kernel's base address by KASLR. With this information, the attacker can calculate the exact memory addresses of kernel functions and data structures, which is necessary for building a reliable kernel exploitation payload. In the Pegasus/Trident chain, CVE-2016-4657 first achieved code execution within the Safari WebKit process through a malicious web page, then CVE-2016-4655 was used from that execution context to determine the kernel memory layout, and finally CVE-2016-4656 exploited a kernel memory corruption vulnerability at the now-known addresses to achieve persistent jailbreak with root-level access.
Frequently Asked Questions
Is CVE-2016-4655 being actively exploited?
Yes, CVE-2016-4655 was actively exploited as a zero-day in the NSO Group's Pegasus spyware chain. CISA has confirmed active exploitation and added it to the KEV catalog. The EPSS percentile of 99.2% reflects near-certain exploitation activity.
What products are affected by CVE-2016-4655?
CVE-2016-4655 affects Apple iOS versions prior to 9.3.5. The vulnerability is in the iOS kernel and impacts all iPhone and iPad models running affected firmware versions.
How do I fix CVE-2016-4655?
Update Apple iOS to version 9.3.5 or later, which patches CVE-2016-4655 and the related Trident vulnerabilities. Enable automatic updates to ensure timely protection. See the Remediation section for additional security measures.
How severe is CVE-2016-4655?
CVE-2016-4655 is a kernel information disclosure vulnerability with an EPSS percentile of 99.2%. While the direct impact is information disclosure, it is a critical component of the Pegasus/Trident exploit chain that achieved full remote jailbreak of iOS devices. Its role in enabling kernel KASLR bypass makes it essential for reliable exploitation of accompanying kernel vulnerabilities.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.