voucher_swap: Exploiting MIG reference counting in iOS 12

Summary: Brandon Azad of Google Project Zero described CVE-2019-6225, a MIG reference counting vulnerability in XNU's task_swap_mach_voucher() function that he exploited on iOS 12.1.2 to build a fake kernel task port with read and write access to arbitrary kernel memory. The placeholder implementation leaks a voucher reference by overwriting in_out_old_voucher without calling ipc_voucher_release(), and consumes a reference it does not own by returning new_voucher, giving near-complete control over the voucher's reference count; the bug was independently discovered by @S0rryMybad.
Key Takeaway: A two-line placeholder function in the kernel gave a researcher full arbitrary kernel read/write on iOS 12.1.2, and the same bug was found independently by a second researcher, meaning the primitive was not obscure. Azad notes the exploit is a starting point for analyzing and bypassing ARMv8.3 Pointer Authentication on A12 devices like the iPhone XS.

Read the original at Google Project Zero ↗

Topics: Vulnerabilities & Patching
Mentions: CVE-2019-6225
Related: In-the-wild iOS Exploit Chain 5 Cyber Risks ·
Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026
U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026