Difference between revisions of "CVE-2013-0964"

From The iPhone Wiki
Jump to: navigation, search
m
 
(2 intermediate revisions by 2 users not shown)
Line 13: Line 13:
 
== Jailbreak ==
 
== Jailbreak ==
 
[[User:Planetbeing|planetbeing]] states that he worked out a nice [[jailbreak]] for it, that will never see the light of day. [[i0n1c]] responded that it is difficult to exploit it in a stable way and he would like to see a description for it.
 
[[User:Planetbeing|planetbeing]] states that he worked out a nice [[jailbreak]] for it, that will never see the light of day. [[i0n1c]] responded that it is difficult to exploit it in a stable way and he would like to see a description for it.
  +
  +
== First page of memory ==
  +
The first page of kernel memory (and eDRAM) contains the sleep token. The sleep token is used from LLB to resume the system and restore its context accordingly. To jump back to the kernel, the LLB checks for the 'MOSX,SUSP' signature in the image and then calls 'jump_to' to exit the bootloader and return control to the OS.
   
 
== Process ==
 
== Process ==
[[Category:Pages with TODO sections]]
 
 
TODO: Describe copyin/copyout functions and the fix in detail.
 
TODO: Describe copyin/copyout functions and the fix in detail.
   
Line 29: Line 31:
   
 
{{stub|exploit}}
 
{{stub|exploit}}
  +
[[Category:Exploits]]

Latest revision as of 15:43, 18 August 2013

CVE-2013-0964 is an vulnerability in the kernel of iOS. It was initially discovered by Mark Dowd and Tarjei Mandt who presented it at HiTB 2012 in Kuala Lumpur. This vulnerability allows userland processes access to the first page of the kernel, because the copyin and copyout arguments were not checked for their range when the length is small enough. Apple patched the vulnerability in iOS 6.1.

Credit

Apple's description

Impact: A user-mode process may be able to access the first page of kernel memory
Description: The iOS kernel has checks to validate that the user-mode pointer and length passed to the copyin and copyout functions would not result in a user-mode process being able to directly access kernel memory. The checks were not being used if the length was smaller than one page. This issue was addressed through additional validation of the arguments to copyin and copyout.

Jailbreak

planetbeing states that he worked out a nice jailbreak for it, that will never see the light of day. i0n1c responded that it is difficult to exploit it in a stable way and he would like to see a description for it.

First page of memory

The first page of kernel memory (and eDRAM) contains the sleep token. The sleep token is used from LLB to resume the system and restore its context accordingly. To jump back to the kernel, the LLB checks for the 'MOSX,SUSP' signature in the image and then calls 'jump_to' to exit the bootloader and return control to the OS.

Process

TODO: Describe copyin/copyout functions and the fix in detail.

TODO: Describe how this can get exploited in a stable way.

References

  1. Apple: iOS 6.1 Software Update

External Links

Tango Utilities-terminal.png This exploit article is a "stub", an incomplete page. Please add more content to this article and remove this tag.