Forest Global Training Partners

Cyber Risks · Google Project Zero

JITSploitation III: Subverting Control Flow

Summary: Google Project Zero's Samuel Groß published the third part of a series on a Safari renderer exploit, detailing how iOS 13's JIT hardenings - APRR and PAC - can be bypassed; the exploited vulnerability CVE-2020-9802 was fixed in iOS 13.5, while two mitigation bypasses, CVE-2020-9870 and CVE-2020-9910, were fixed in iOS 13.6. The post explains that APRR enforces W^X on the JIT region by unlocking it only briefly for a single thread, and PAC enforces control-flow integrity and verifies a hash over emitted machine code before it is copied into the JIT region.

Bottom line: The mitigations that make iOS exploitation expensive - APRR's per-thread W^X and PAC's pointer signing - were each bypassed by the same researcher in a single project, and the fixes landed across two separate iOS releases, 13.5 and 13.6.

Read the original at Google Project Zero ↗

Topics
Vulnerabilities & Patching
Mentions
CVE-2020-9802CVE-2020-9870CVE-2020-9910
Related