admin/ave27

0 Fork 0

Files

T

JBJF bc019e2b6c AVE27 — standalone POC app for CVE-2026-112705 (AppleAVE2 NTL OOB write)

- All stages ported from MchinaMd57764/AVETemporalPoC (orig. Calif/Chollima):
  stage1-12, 20, 21, fuzz, SBE — launch-arg parity kept
- New: stage13 NTL threshold sweep, stage14 usage×rc acceptance matrix,
  stage15 private-key entitlement audit (23 keys)
- Panic journal: kern.boottime-based in-app panic evidence after reboot
- Interactive SwiftUI console + NTL field + report share; header shows
  PANIC-CAPABLE on iOS 27.0-27.1, FIXED BUILD on 27.2+
- App icon: temporal-layer stack, top layer displaced past the stack edge
- scripts/build-device.sh → unsigned arm64 IPA (iOS 17.0+)

2026-10-30 19:13:13 +08:00

3.5 KiB

Raw Permalink Blame History

AVE27 — standalone POC app for CVE-2026-112705

Standalone iOS app for CVE-2026-112705 — AppleAVE2 kernel out-of-bounds write via NumberOfTemporalLayers (VideoToolbox). Original discovery: Calif / Chollima team; this app ports the reproduction from MchinaMd57764/AVETemporalPoC-CVE-2026-112705 into a self-contained, interactive harness and extends it with exploration stages.

Component: com.apple.driver.AppleAVE2 (kernel)
Type: kernel OOB write, fixed-offset constant fill — panic/DoS, no read/write primitive
Affected: iOS 27.0 – 27.1 (24A446 line)
Fixed: iOS 27.2 — NTL returns -12900 at SetProperty, no panic
Highest supported target: iOS 27.1

What the app does

All nine original stages ported verbatim (props readback, encode trigger, property fuzz, multi-PPS, layer-ID probe, bitstream dump, NTL ladder, per-rung parameter-set capture, DPB-array overflow, UserDPB IOSurface table, H.264 slice-count decode, MVHEVC ID validation, sandbox-extension probe), plus three new exploration stages:

Stage	What it maps
stage9	the panic trigger: `EncoderUsage=1` + `RCMode=20` + `NTL=16463` → first encode panics AppleAVE2 (kernel data abort, `far=0x59 x19=0x1`); 16462 survives
stage13	NTL threshold sweep, bottom-up, one session per rung — finds the exact landing rung; panic journal arms per rung
stage14	`EncoderUsage` × `RCMode` acceptance matrix at a safe layer count — which private mode selectors the driver honours from a stock app
stage15	private-key audit: 23 non-public VideoToolbox keys set from an unentitled sandboxed app; the accepted set is the privilege surface reaching AppleAVE2
SBE	sandbox-extension issuance probe — can a third-party app issue read/write extensions for paths outside its container
panic journal	armed before every panic-capable encode; on next launch, an unfinished journal + changed `kern.boottime` = that run ended in a kernel panic, in-app, no console needed

Interactive UI: stage buttons, NTL field, live monospaced console, report share sheet. Launch-argument mode keeps full parity with the original repo (--stage9 16463, --stage13, --fuzz, --sbext, …). Report lands in Documents/ave_report.txt, live oracle in Documents/live.txt — the last line before a panic is stage9(...) encode[0].

Building

bash scripts/build-device.sh     # → dist/AVE27-unsigned.ipa (arm64, iOS 17.0+, unsigned)
python3 scripts/gen_icon.py      # regenerates the app icon (no image library needed)

Unsigned IPA — sign with your own certificate + provisioning profile, then sideload. The simulator has no hardware encode path; panic stages need a real device on 27.0/27.1.

Panic evidence workflow

Launch → tap stage9 panic (or --stage9 16463). Device reboots.
Relaunch. The header still says PANIC-CAPABLE; the console opens with the journal verdict: which stage, which rung, which boot — and points at Settings → Privacy → Analytics for the matching .ips.
Export ave_report.txt / live.txt from Files → AVE27.

Credits & scope

Original discovery and panic evidence: Calif / Chollima team, independent reproduction by MchinaMd57764. This app reproduces a public, already-patched CVE for verification and research on devices you own. It contains no exploitation code — the defect is a fixed-offset constant fill with no read/write capability.