CVE-2013-0964 - Revision history

Winocm at 15:43, 18 August 2013

2013-08-18T15:43:49Z

Http: CVE is a vulnerability, but it got exploited, so it belongs to the Exploits category. If you think not, please comment.

2013-08-17T22:11:41Z

CVE is a vulnerability, but it got exploited, so it belongs to the Exploits category. If you think not, please comment.

IAdam1n at 23:38, 14 August 2013

2013-08-14T23:38:15Z

IAdam1n at 23:37, 14 August 2013

2013-08-14T23:37:49Z

5urd at 22:43, 12 April 2013

2013-04-12T22:43:00Z

5urd at 19:03, 31 January 2013

2013-01-31T19:03:15Z

5urd: Still needs work

2013-01-31T19:02:54Z

Still needs work

Http: initial page

2013-01-31T02:16:32Z

initial page

New page

Initially discovered by [[mdowd|Mark Dowd]] and [[kernelpool|Tarjei Mandt]] and presented at [[HiTB]] 2012 in Kuala Lumpur, this vulnerability allows userland processes access to the first page of the kernel, because the copyin and copyout arguments were not checked for ranges when the length is small enough. It was fixed with the release of iOS 6.1.

Description of Apple:

<cite>
Impact: A user-mode process may be able to access the first page of kernel memory<br/>
Description: The iOS kernel has checks to validate that the user-mode pointer and length passed to the copyin and copyout functions would not result in a user-mode process being able to directly access kernel memory. The checks were not being used if the length was smaller than one page. This issue was addressed through additional validation of the arguments to copyin and copyout.
</cite>

[[User:Planetbeing|planetbeing]] said he worked out a nice jailbreak for it, that will never see the light of day. [[i0n1c]] answered it is difficult to exploit it in a stable way and he would like to see a description.

TODO: Describe copyin/copyout functions and the fix in detail.

TODO: Describe how this can get exploited in a stable way.

===References===
*[http://support.apple.com/kb/HT5642 Apple: iOS 6.1 Software Update]
*[http://conference.hackinthebox.org/hitbsecconf2012kul/materials/D1T2%20-%20Mark%20Dowd%20&%20Tarjei%20Mandt%20-%20iOS6%20Security.pdf Mark Dowd & Tarjei Mandt's iOS6 presentation at HITB 2012 KUL D1T2]
*[https://twitter.com/planetbeing/status/296050713874796544 Planetbeing saying he had a jailbreak for it]
*[https://twitter.com/i0n1c/status/296163383357620225 i0n1c saying it's difficult to exploit it stable]

{{stub|firmware}}
[[Category:Exploits]]

@@ Line 13: / Line 13: @@
 == Jailbreak ==
 [[User:Planetbeing|planetbeing]] states that he worked out a nice [[jailbreak]] for it, that will never see the light of day. [[i0n1c]] responded that it is difficult to exploit it in a stable way and he would like to see a description for it.
 == Process ==

← Older revision		Revision as of 22:11, 17 August 2013
Line 28:		Line 28:

	{{stub\|exploit}}		{{stub\|exploit}}
		+	[[Category:Exploits]]

← Older revision		Revision as of 23:38, 14 August 2013
Line 15:		Line 15:

	== Process ==		== Process ==
−	[[Category:Pages with TODO sections]]
	TODO: Describe copyin/copyout functions and the fix in detail.		TODO: Describe copyin/copyout functions and the fix in detail.

← Older revision		Revision as of 23:37, 14 August 2013
Line 29:		Line 29:

	{{stub\|exploit}}		{{stub\|exploit}}
−	[[Category:Exploits]]

@@ Line 12: / Line 12: @@
 == Jailbreak ==
-[[User:Planetbeing|planetbeing]] states that he worked out a nice [[jailbreak]] for it, that will never see the light of day<sup>{{man|CITE}}</sup>. [[i0n1c]] responded that it is difficult to exploit it in a stable way and he would like to see a description for it.
+[[User:Planetbeing|planetbeing]] states that he worked out a nice [[jailbreak]] for it, that will never see the light of day. [[i0n1c]] responded that it is difficult to exploit it in a stable way and he would like to see a description for it.
 == Process ==

@@ Line 28: / Line 28: @@
 * [https://twitter.com/i0n1c/status/296163383357620225 i0n1c saying it's difficult to exploit it stable]
-{{stub|firmware}}
+{{stub|exploit}}
 [[Category:Exploits]]

@@ Line 1: / Line 1: @@
-Initially discovered by [[mdowd|Mark Dowd]] and [[kernelpool|Tarjei Mandt]] and presented at [[HiTB]] 2012 in Kuala Lumpur, this vulnerability allows userland processes access to the first page of the kernel, because the copyin and copyout arguments were not checked for ranges when the length is small enough. It was fixed with the release of iOS 6.1.
+'''CVE-2013-0964''' is an [[exploit|vulnerability]] in the [[kernel]] of [[iOS]]. It was initially discovered by [[mdowd|Mark Dowd]] and [[kernelpool|Tarjei Mandt]] who presented it at [[HiTB]] 2012 in Kuala Lumpur. This vulnerability allows userland processes access to the first page of the kernel, because the <code>copyin</code> and <code>copyout</code> arguments were not checked for their range when the length is small enough. Apple patched the vulnerability in iOS 6.1.
 <cite>
 Impact: A user-mode process may be able to access the first page of kernel memory<br/>
@@ Line 8: / Line 11: @@
 </cite>
 TODO: Describe copyin/copyout functions and the fix in detail.
 TODO: Describe how this can get exploited in a stable way.
-===References===
+== References ==
-*[http://support.apple.com/kb/HT5642 Apple: iOS 6.1 Software Update]
+# [http://support.apple.com/kb/HT5642 Apple: iOS 6.1 Software Update]
 {{stub|firmware}}