CVE-2016-4657
Apple iOS Webkit Memory Corruption Vulnerability
Description
CVE-2016-4657 is a memory corruption vulnerability in Apple iOS WebKit that allows remote attackers to execute code or cause a denial-of-service (DoS) via a crafted website. This vulnerability affects all HTML parsers that use WebKit, including Apple Safari and non-Apple products that rely on WebKit for HTML processing. CVE-2016-4657 served as the initial entry point in the Pegasus/Trident exploit chain developed by the NSO Group, enabling remote code execution through a single malicious link. CISA has added this vulnerability to its KEV catalog, and its EPSS percentile of 98.9% indicates near-certain exploitation activity.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| apple | iphone os | < 9.3.5 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
References
- http://lists.apple.com/archives/security-announce/2016/Aug/msg00000.html(Broken Link, Mailing List, Vendor Advisory)
- http://www.securityfocus.com/bid/92653(Broken Link, Third Party Advisory, VDB Entry)
- http://www.securitytracker.com/id/1036694(Broken Link, Third Party Advisory, VDB Entry)
- https://blog.lookout.com/blog/2016/08/25/trident-pegasus/(Broken Link)
- https://support.apple.com/HT207107(Release Notes, Vendor Advisory)
- https://www.exploit-db.com/exploits/44836/(Exploit, Third Party Advisory, VDB Entry)
- https://www.youtube.com/watch?v=xkdPjbaLngE(Exploit)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2016-4657(US Government Resource)
Weakness Type
CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer
CWE-119 describes a weakness where a product performs operations on a memory buffer without properly restricting those operations to the intended boundaries. In CVE-2016-4657, the WebKit engine in Apple iOS fails to properly handle certain HTML and JavaScript content, leading to memory corruption that an attacker can exploit to achieve arbitrary code execution within the Safari browser process.
Learn more: CWE-119 — Improper Restriction of Operations within the Bounds of a Memory Buffer
Impact Analysis
CVE-2016-4657 enables remote code execution through a simple web page visit, making it an extremely effective initial access vector. The vulnerability is exploitable remotely without authentication, requiring only that the user clicks a malicious link or visits a compromised website. While the initial code execution occurs within the Safari/WebKit sandbox, it served as the crucial first step in the Pegasus/Trident chain that escalated to full device compromise. The impact extends beyond Apple Safari to any application or product using the WebKit HTML rendering engine. The EPSS percentile of 98.9% reflects near-certain exploitation, and CISA has confirmed active exploitation in the KEV catalog. The ease of exploitation through a single click on a crafted link makes this vulnerability particularly dangerous for targeted attacks.
Exploit Maturity
CVE-2016-4657 was exploited as a zero-day vulnerability in the Pegasus/Trident exploit chain discovered in August 2016. CISA has confirmed active exploitation and added it to the Known Exploited Vulnerabilities catalog with a remediation deadline of June 14, 2022. The EPSS percentile of 98.9% indicates near-certain exploitation probability. The NSO Group developed this exploit as the initial access component of their Pegasus commercial spyware platform. The attack was delivered via a crafted URL sent through SMS or messaging apps, and when the victim clicked the link, the WebKit vulnerability was triggered in the Safari browser, providing initial code execution that was then chained with CVE-2016-4655 (KASLR bypass) and CVE-2016-4656 (kernel exploitation) for complete device compromise.
Remediation
- Update Apple iOS to version 9.3.5 or later, which patches CVE-2016-4657 along with the other Pegasus/Trident vulnerabilities. Apply updates per vendor instructions as required by CISA's KEV catalog.
- Update all applications and products that use WebKit for HTML rendering, as the vulnerability is not limited to Apple Safari.
- Enable automatic updates on all iOS devices to ensure timely deployment of WebKit security patches.
- Exercise caution when clicking links from unknown or untrusted sources. Organizations should implement link scanning in email and messaging security gateways to detect and block malicious URLs.
- Deploy mobile device management (MDM) solutions with web content filtering capabilities to block access to known malicious domains and provide an additional layer of protection against WebKit-based exploits.
Technical Details
CVE-2016-4657 is a memory corruption vulnerability in the WebKit HTML rendering engine used by Apple iOS Safari and other WebKit-based applications. When WebKit processes specially crafted HTML and JavaScript content, it fails to properly manage memory buffers during rendering operations, falling under CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer). The attacker crafts a web page that triggers the memory corruption, allowing controlled overwrite of memory structures that redirects execution flow to attacker-supplied code. In the Pegasus/Trident chain, this code then executed within the Safari process sandbox and proceeded to exploit CVE-2016-4655 and CVE-2016-4656 to escape the sandbox and achieve kernel-level access. The attack required only that the victim navigate to the malicious URL, making it a one-click full device compromise when combined with the other chain components.
Frequently Asked Questions
Is CVE-2016-4657 being actively exploited?
Yes, CVE-2016-4657 was exploited as a zero-day in the NSO Group's Pegasus spyware chain. CISA has confirmed active exploitation and added it to the KEV catalog. The EPSS percentile of 98.9% reflects near-certain exploitation, driven by the Pegasus commercial spyware platform.
What products are affected by CVE-2016-4657?
CVE-2016-4657 affects the WebKit engine in Apple iOS versions prior to 9.3.5. The impact extends to all applications and products that use WebKit for HTML rendering, including Apple Safari and non-Apple products that embed the WebKit engine.
How do I fix CVE-2016-4657?
Update Apple iOS to version 9.3.5 or later. Also update all other applications that use WebKit for HTML rendering. Enable automatic updates for ongoing protection. See the Remediation section for additional security measures.
How severe is CVE-2016-4657?
CVE-2016-4657 is a remote code execution vulnerability with an EPSS percentile of 98.9%. It enables code execution through a simple link click, making it extremely dangerous for targeted attacks. As the initial entry point of the Pegasus/Trident chain, it enabled complete remote jailbreak of iOS devices via a single malicious URL.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.