Attacking iPhone XS Max

on YouTube ↗35m

" summary

Identifies an XNU Unix domain socket race that creates a use‑after‑free via UNP bind temporary unlock and shows a concrete exploit chain: close sockets, trigger zone GC, spray controllable OSData and pipe buffers, replace freed memory with OOL port descriptors to build a fake kernel task/TFP0, then achieve arbitrary kernel read/write and KASLR leak. Shows PAC on A12 blocks direct ROP, and bypasses it by abusing saved thread context and invoking a PPL entry to load a trust cache, yielding a working iPhone XS Max jailbreak and SSH.

AI-written summary · about

" chapters (16)

1. 0:00Intro
2. 1:10Outline
3. 2:03Unix Domain Socket
4. 5:41Race Condition
5. 9:56The fix
6. 10:39The pattern
7. 11:45UAF, let's look at the USE
8. 12:32Binary version may be better
9. 17:40PAC (Pointer Authentication Code)
10. 21:51UAF, let's look at the second USE
11. 25:49Got troubles while adding trust caches
12. 27:42tfpo's write capability for kernel image
13. 29:04Look for unprotected control flow transfer points
14. 32:07What can we do
15. 33:18Got ssh on iPhone XS Max
16. 33:40Black Hat Sound Bytes

" related talks

• 37mAttacking The XNU Kernel In El CapitainLuca Todesco · Black Hat Europe 2015
• 50mRo(o)tten Apples: Vulnerability Heaven in the iOS SandboxAdam Donenfeld · Black Hat Europe 2017
• 37mEternal War in XNU Kernel ObjectsXiaolong Bai, Min (Spark) Zheng · Black Hat Europe 2018
• 40mIntroduction into Reverse Engineering and iOS SecurityCyril Cermak · #Pragma Conference 2023
• 50mFinding Vulnerabilities In iOS/MacOS Networking CodeKevin Backhouse · HITBSecConf 2019 Amsterdam
• 54mSubverting Apple Graphics: Practical Approaches to Remotely Gaining RootMarco Grassi, Liang Chen, Qidan He, Yubin Fu · Black Hat USA 2016
• 44mExploiting Unpatched iOS Vulnerabilities for Fun and ProfitByoungyoung Lee, Yeongjin Jang, Tielei Wang, Billy Lau · Black Hat USA 2014
• 29miOS Runtime Manipulation (PWND)Cyril Cermak · DevWorld 2024