Examining Pointer Authentication on the iPhone XS
Summary: Google Project Zero researcher Brandon Azad examined Apple's Pointer Authentication implementation on the A12 SoC in the iPhone XS and demonstrated using an arbitrary kernel read/write primitive to forge kernel PAC signatures for the A keys, sufficient to execute arbitrary code in the kernel via JOP. The technique was mostly fixed in iOS 12.1.3, with the fix first appearing in the 16D5032a beta while his research was still ongoing.
What's compelling: The attack worked because iOS devices appear not to run a hypervisor or secure monitor, leaving the EL1 kernel to manage its own PAC keys, which must be stored in kernel memory when the core sleeps - so an attacker with kernel memory access could read them and forge authentication codes for arbitrary pointers.
Read the original at Google Project Zero ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026