Forest Global Training Partners

Cyber Risks · Google Project Zero

Remote iPhone Exploitation Part 3: From Memory Corruption to Java Script and Back -- Gaining Code Execution

Summary: Project Zero's Samuel Groß published the third and final post in a series on a remote, interactionless iPhone exploit over iMessage, showing how to turn the vulnerability into native code execution on devices without pointer authentication, namely the iPhone X and earlier. The technique uses a heap spray to place a fake object and fake class with a controlled method cache entry for 'isNSString__', then triggers the bug so [NSString isEqual:] invokes that method and points the instruction pointer at an attacker-chosen address, followed by a stack pivot and ROP payload.

Key Takeaway: The exploit requires no user interaction and arrives over iMessage, and the write-up notes that with PAC enabled the attack only fails because PAC does not protect the ISA value, leaving fake ObjC instances of any class in the dyld shared cache possible once the cache base address is known. The chain also shows how a memory corruption bug can be converted into an objc_release call on an attacker-controlled object, a primitive the author says applies to many such vulnerabilities.

Read the original at Google Project Zero ↗

Topics
Vulnerabilities & Patching
Related