admin/cinder27
1
1 Fork 3
Code Issues Pull Requests Actions Packages Projects Releases 6 Wiki Activity

kernel diff: correct to the iPhone19,7 v6x-pandia kernelcache (304 fileset entries, v6x addresses)

Browse Source
This commit is contained in:
JBJF committed 2026-10-31 17:48:34 +08:00
1 parent c7d4043a8c
commit 9d6c44de61
1 file changed
+13 -9
Download Patch File Download Diff File Expand all files Collapse all files
docs/IOS27.2-KERNEL-DIFF.md
+13 -9
View File
@@ -20,11 +20,15 @@ analysis did not wait for the full 26 GB. The container is IM4P; the payload is
| Build | Kernelcache (decoded) | SHA-256 (first 16) |
|---|---|---|
| 27.0.1 | 78,315,520 B | `dec73956a9a443c5` |
| 27.2 | 79,167,488 B | `9a6efbc4be67319a` |
| 27.2 (v6x-pandia) | 78,675,968 B | `1aaf47dbc73650e3` |
Both are `MH_FILESET` images with a `__DATA_SPTM` segment, carrying 303 (27.0.1) and
305 (27.2) fileset entries. Two kexts are new: `com.apple.driver.ApplePencilDriver`,
`com.apple.iokit.AppleSecurityResearch`; none were removed.
Both are `MH_FILESET` images with a `__DATA_SPTM` segment, carrying 303 (27.0.1)
and 304 (27.2) fileset entries. One kext is new: `com.apple.driver.ApplePencilDriver`;
none were removed.
27.2 ships three kernelcaches (`v63`, `v64`, `v6x-pandia`); iPhone19,7 uses
`v6x-pandia` (member SHA-256 `0777eb09…`). The numbers and addresses below are
from that member, not from the first kernelcache in the ZIP.
## Reading the diff
@@ -36,7 +40,7 @@ code is unchanged. The diff therefore keys on:
2. `__cstring` / `__oslogstring` set difference (new checks usually add a message),
3. `llvm-objdump` instruction diff for the kexts that survive both filters.
93 of 303 common kexts changed text size. The largest are the ones the advisory
93 of 303 common kexts changed text size (v6x-pandia). The largest are the ones the advisory
points at:
| Delta | Kext | Advisory component |
@@ -154,10 +158,10 @@ so treat the CVE attribution as an inference.
| New string | Function (27.2) | Likely area |
|---|---|---|
| `size <= sdl->sdl_alen` | `0xfffffe000af62474` (assert at `0xfffffe000af6274c`) | sockaddr_dl / ifaddr bounds (info leak candidate, cf. 112665) |
| `Failed mbuf validity check` | `0xfffffe000af238ac`, `0xfffffe000af42e70`, `0xfffffe000b08a1bc`, `0xfffffe000b1357a0` | mbuf length vs off+len (OOB read/write candidate) |
| `VM entry %p lock shared lock overflow` | `0xfffffe000b52ed74` | vm_map shared-lock state (COW / 112576 candidate) |
| `Page modified after framebank withdraw %p` | `0xfffffe000adf71b8` | pmap page lifecycle (UAF candidate) |
| `size <= sdl->sdl_alen` | `0xfffffe000aeee474` (assert at `0xfffffe000aeee74c`) | sockaddr_dl / ifaddr bounds (info leak candidate, cf. 112665) |
| `Failed mbuf validity check` | `0xfffffe000aeaf8ac`, `0xfffffe000aecee70`, `0xfffffe000b0161bc`, `0xfffffe000b0c17a0` | mbuf length vs off+len (OOB read/write candidate) |
| `VM entry %p lock shared lock overflow` | `0xfffffe000b4bad74` | vm_map shared-lock state (COW / 112576 candidate) |
| `Page modified after framebank withdraw %p` | `0xfffffe000ad831b8` | pmap page lifecycle (UAF candidate) |
The `sdl` site is the most user-reachable of the four: it is on the network
interface/address path and the string is an assertion added in 27.2. The mbuf