Ro(o)tten Apples: Vulnerability Heaven in the iOS Sandbox
summary
Finds a chain in the AppleAVE IOKit driver that yields a full kernel privilege escalation bypassing KPP/AMCC and SMAP/PAN by combining an infoleak of IOSurface kernel addresses with a fake IOSurface kernel object primitive. Uses persistent XML property spray to place fake vtables, then overwrites syscall function pointers via a serializer/copyin gadget to get deterministic arbitrary kernel read/write and controlled function calls. Exploit is implemented, reliable on 10.2–10.3.1 variants, and reached working root within about two weeks; code is on GitHub.
AI-written summary · about
chapters (8)
- 0:00Start
- 11:52Usermode to Kernel communication
- 20:41Base kernel leak
- 27:28Main plan
- 28:38Kernel base
- 32:18Heap spray
- 35:54Hijacking kernel execution
- 43:10Jailbreak project
related talks
44mExploiting Unpatched iOS Vulnerabilities for Fun and Profit
54mSubverting Apple Graphics: Practical Approaches to Remotely Gaining Root
25mThe Last Line of Defense: Understanding and Attacking Apple File System on iOS
40m(P)FACE into the Apple core and exploit to root
34mTowards Discovering Remote Code Execution Vulnerabilities in Apple FaceTime
57mExploring Yosemite: Abusing Mac OS X 10.10
36mThe Price of Compatibility: Defeating macOS Kernel Using Extended File Attributes
50mTake a Jailbreak -Stunning Guards for iOS Jailbreak-