ndrv_setspec() Integer Overflow

From The iPhone Wiki
Revision as of 05:23, 23 September 2011 by Jacob (talk | contribs) (Slides added to keep things simple)
Jump to: navigation, search

The ndrv_setspec() Integer Overflow is a vulnerability found in the kernel. i0n1c used this to make the first (publicly released) "untethering" exploit that bypassed Apple's ASLR implementation.

Vulnerability

This exploit was talked about by I0n1c at Blackhat US 2011 in his Exploiting The iOS Kernel presentation starting at slide 41.

I0n1c-slide42.jpg I0n1c-slide43.jpg I0n1c-slide44.jpg I0n1c-slide45.jpg I0n1c-slide46.jpg