Exception-oriented exploitation on iOS
Project Zero's Ian Beer documented CVE-2017-2370, a heap buffer overflow in the mach_voucher_extract_attr_recipe_trap mach trap added in iOS 10, where a copy-paste error left copyin reading a userspace pointer as the copy length instead of the validated sz...