Over The Air - Vol. 2, Pt. 3: Exploiting The Wi-Fi Stack on Apple Devices
Summary: Google Project Zero's Gal Beniamini completed a chain that achieved remote kernel code execution on the iPhone 7 over Wi-Fi alone, building on a prior Wi-Fi firmware exploit to take control of the XNU kernel. The post identifies seven vulnerabilities in how the host interacts with the Wi-Fi chip, all reported to Apple and fixed in iOS 11.
Bottom line: Apple connected the Wi-Fi chip over PCIe starting with the iPhone 6, giving the peripheral DMA access to host memory that only an IOMMU (Apple's DART) can contain - and Project Zero had already found no such isolation on Qualcomm's Snapdragon 810 and Samsung's Exynos 8890, where a compromised Wi-Fi chip meant full device compromise.
Read the original at Google Project Zero ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026