for those looking for a TLDR:
- Result: run unauthorized code on iOS 14
- 14 is the most secure toy phone OS to date, with kernel heap hardening, data PAC, userspace PAC hardening, tfp0 hardening, ipc_kmsg hardening
- Exploit took advantage of multiple bugs, concentrating on PAC (Pointer Authentication Code, cryptographic signature on the pointer value, designed to resist memory disclosure attacks, for more context see [1])
- Multiple steps and dependencies, chaining vulnerabilities and exploits
- Code on https://github.com/pattern-f
I really commend Zuozhi Fan (@pattern_F_)for publishing the code with the report.
Additional resources:
[1] https://googleprojectzero.blogspot.com/2019/02/examining-poi...
- Result: run unauthorized code on iOS 14
- 14 is the most secure toy phone OS to date, with kernel heap hardening, data PAC, userspace PAC hardening, tfp0 hardening, ipc_kmsg hardening
- Exploit took advantage of multiple bugs, concentrating on PAC (Pointer Authentication Code, cryptographic signature on the pointer value, designed to resist memory disclosure attacks, for more context see [1])
- Multiple steps and dependencies, chaining vulnerabilities and exploits
- Code on https://github.com/pattern-f
I really commend Zuozhi Fan (@pattern_F_)for publishing the code with the report.
Additional resources:
[1] https://googleprojectzero.blogspot.com/2019/02/examining-poi...