JBJF
bc019e2b6c
- All stages ported from MchinaMd57764/AVETemporalPoC (orig. Calif/Chollima): stage1-12, 20, 21, fuzz, SBE — launch-arg parity kept - New: stage13 NTL threshold sweep, stage14 usage×rc acceptance matrix, stage15 private-key entitlement audit (23 keys) - Panic journal: kern.boottime-based in-app panic evidence after reboot - Interactive SwiftUI console + NTL field + report share; header shows PANIC-CAPABLE on iOS 27.0-27.1, FIXED BUILD on 27.2+ - App icon: temporal-layer stack, top layer displaced past the stack edge - scripts/build-device.sh → unsigned arm64 IPA (iOS 17.0+)
62 lines
3.5 KiB
Markdown
62 lines
3.5 KiB
Markdown
# AVE27 — standalone POC app for CVE-2026-112705
|
||
|
||
Standalone iOS app for **CVE-2026-112705** — AppleAVE2 kernel out-of-bounds write
|
||
via `NumberOfTemporalLayers` (VideoToolbox). Original discovery: Calif / Chollima
|
||
team; this app ports the reproduction from
|
||
[MchinaMd57764/AVETemporalPoC-CVE-2026-112705](https://github.com/MchinaMd57764/AVETemporalPoC-CVE-2026-112705)
|
||
into a self-contained, interactive harness and extends it with exploration stages.
|
||
|
||
- Component: `com.apple.driver.AppleAVE2` (kernel)
|
||
- Type: kernel OOB write, fixed-offset constant fill — panic/DoS, **no** read/write primitive
|
||
- Affected: iOS 27.0 – 27.1 (24A446 line)
|
||
- Fixed: iOS 27.2 — `NTL` returns `-12900` at SetProperty, no panic
|
||
- Highest supported target: **iOS 27.1**
|
||
|
||
## What the app does
|
||
|
||
All nine original stages ported verbatim (props readback, encode trigger, property
|
||
fuzz, multi-PPS, layer-ID probe, bitstream dump, NTL ladder, per-rung parameter-set
|
||
capture, DPB-array overflow, UserDPB IOSurface table, H.264 slice-count decode,
|
||
MVHEVC ID validation, sandbox-extension probe), plus three new exploration stages:
|
||
|
||
| Stage | What it maps |
|
||
|---|---|
|
||
| **stage9** | the panic trigger: `EncoderUsage=1` + `RCMode=20` + `NTL=16463` → first encode panics AppleAVE2 (kernel data abort, `far=0x59 x19=0x1`); 16462 survives |
|
||
| **stage13** | NTL threshold sweep, bottom-up, one session per rung — finds the exact landing rung; panic journal arms per rung |
|
||
| **stage14** | `EncoderUsage` × `RCMode` acceptance matrix at a safe layer count — which private mode selectors the driver honours from a stock app |
|
||
| **stage15** | private-key audit: 23 non-public VideoToolbox keys set from an unentitled sandboxed app; the accepted set is the privilege surface reaching AppleAVE2 |
|
||
| **SBE** | sandbox-extension issuance probe — can a third-party app issue read/write extensions for paths outside its container |
|
||
| panic journal | armed before every panic-capable encode; on next launch, an unfinished journal + changed `kern.boottime` = that run ended in a kernel panic, in-app, no console needed |
|
||
|
||
Interactive UI: stage buttons, NTL field, live monospaced console, report share
|
||
sheet. Launch-argument mode keeps full parity with the original repo
|
||
(`--stage9 16463`, `--stage13`, `--fuzz`, `--sbext`, …). Report lands in
|
||
`Documents/ave_report.txt`, live oracle in `Documents/live.txt` — the last line
|
||
before a panic is `stage9(...) encode[0]`.
|
||
|
||
## Building
|
||
|
||
```bash
|
||
bash scripts/build-device.sh # → dist/AVE27-unsigned.ipa (arm64, iOS 17.0+, unsigned)
|
||
python3 scripts/gen_icon.py # regenerates the app icon (no image library needed)
|
||
```
|
||
|
||
Unsigned IPA — sign with your own certificate + provisioning profile, then
|
||
sideload. The simulator has no hardware encode path; panic stages need a real
|
||
device on 27.0/27.1.
|
||
|
||
## Panic evidence workflow
|
||
|
||
1. Launch → tap **stage9 panic** (or `--stage9 16463`). Device reboots.
|
||
2. Relaunch. The header still says PANIC-CAPABLE; the console opens with the
|
||
journal verdict: which stage, which rung, which boot — and points at
|
||
Settings → Privacy → Analytics for the matching `.ips`.
|
||
3. Export `ave_report.txt` / `live.txt` from Files → AVE27.
|
||
|
||
## Credits & scope
|
||
|
||
Original discovery and panic evidence: **Calif / Chollima team**, independent
|
||
reproduction by MchinaMd57764. This app reproduces a public, already-patched CVE
|
||
for verification and research on devices you own. It contains no exploitation
|
||
code — the defect is a fixed-offset constant fill with no read/write capability.
|