JITSploitation II: Getting Read/Write
Summary: Project Zero's Samuel Groß detailed how a Safari JIT bug, CVE-2020-9802, was turned into a stable arbitrary memory read/write primitive by faking a JSArray object and reading a legitimate JSCell header to bypass WebKit's StructureID randomization. The write-up also covers bypassing the Gigacage and PACCage protections on TypedArray backing stores, with the vulnerability fixed in iOS 13.5 and two mitigation bypasses, CVE-2020-9870 and CVE-2020-9910, fixed in iOS 13.6.
Key Takeaway: The exploit chain required defeating two separate mitigations - StructureID randomization and the Gigacage - and both bypasses were patched only in a later iOS release, so anyone running iOS 13.5 remained exposed to the full read/write primitive until 13.6 shipped.
Read the original at Google Project Zero ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2020-9802CVE-2020-9870CVE-2020-9910
- Related
- JITSploitation I: A JIT Bug Cyber Risks ·JITSploitation III: Subverting Control Flow Cyber Risks ·Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026