In-the-wild iOS Exploit Chain 2
Summary: Project Zero's Ian Beer documented an in-the-wild iOS exploit chain targeting iOS 10.3 through 10.3.3 on devices from the iPhone 5s through the iPhone 7, built on a kernel bug tracked as CVE-2017-13861. The flaw was in IOSurfaceRootUserClient external method 17 (s_set_surface_notify), which dropped a reference on the wake_port and also returned an error, causing MIG to drop a second reference and producing a use-after-free reachable from inside the MobileSafari renderer sandbox.
Bottom line: The bug was not fixed until iOS 11.2 on December 2nd 2017, and Beer independently discovered and reported it to Apple on October 30th 2017 - after the attackers appear to have stopped using it, with iOS 11 released September 19th 2017 as the first unsupported version. A reference-counting mismatch in a sandbox-reachable IOKit method was enough to hand attackers kernel memory access on devices spanning the iPhone 5s through the iPhone 7.
Read the original at Google Project Zero ↗
- Topics
- Zero-Days & Exploits
- Mentions
- CVE-2017-13861
- Related
- New Sign Drop Exploit Can Abuse Windows Defender to Bypass Security Protections Cyber Risks · Nov 13, 2026New Sign Drop Zero-Day Exploit Turns Windows CLFS Security Feature Into SYSTEM Access Cyber Risks · Nov 12, 2026November Patch Tuesday: An Overflowing Cornucopia of CVEs Cyber Risks · Nov 10, 2026