Remote iPhone Exploitation Part 2: Bringing Light into the Darkness -- a Remote ASLR Bypass
Summary: Project Zero's Samuel Groß described a method to defeat ASLR remotely on iOS without any additional information disclosure vulnerabilities, using heap spraying over iMessage and a crash oracle built on delivery receipts. The released code infers the dyld shared cache base address remotely on vulnerable devices within a couple of minutes, versus roughly 3-4 weeks for a brute force approach that would otherwise trigger launchd restart limiting.
Bottom line: The dyld shared cache is mapped at the same address in every process and randomized only once at device boot, so once its base is known, thousands of ROP gadgets and all ObjC classes across userspace become addressable - and iMessage delivery receipts, which cannot be disabled, provide the feedback channel that makes the inference possible.
Read the original at Google Project Zero ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026