One Byte to rule them all
Summary: Google Project Zero's Brandon Azad described a new iOS kernel exploitation technique that turns a controlled one-byte heap overflow into a read/write primitive for arbitrary physical addresses, sidestepping KASLR, PAC, and zone_require. The technique corrupts the type field of a vm_map_copy_t object so the kernel interprets attacker-controlled data as a fake vm_map_entry hierarchy, reaching pmap_enter_options() with an arbitrary physical page number and mapping arbitrary physical memory into userspace.
What's compelling: A single controlled byte in a kalloc.80 through kalloc.32768 allocation was enough to bypass the mitigations that iOS kernel exploits had been converging against, which means mitigations tuned to the canonical kernel-task-port flow may not cover exploit paths that never touch it.
Read the original at Google Project Zero ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2020-3837
- Related
- CVE-2020-3837: Apple Multiple Products Memory Corruption Vulnerability Known Exploited Vulnerabilities · Jun 27, 2022Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026