admin/cinder27
1
1 Fork 3
Code Issues Pull Requests Actions Packages Projects Releases 6 Wiki Activity
15 Commits 1 Branch 6 Tags
6bb476a534e0210633fd7713222f752f777b1bb3
Commit Graph
10 Commits
Author SHA1 Message Date
JBJF 6bb476a534 kernel diff: candidate fix-site functions for sdl/mbuf/vm_map/framebank checks 2026-10-31 17:35:09 +08:00
JBJF bdb029bb37 SPTM: 27.2 TLBI verification is DeviceTree-gated and the gate is absent on iPhone19,7 
- parser at 0xfffffff0270cbe18 sets the verify flag to 0 when
  /arm-io/sgx lacks verify-gmmu-tlbis-at-sync
- BuildManifest maps iPhone19,7 -> v64sap; that DT lacks the key, as do
  iBoot, AGX and the kernelcache; only SPTM contains the strings
- consequence: the GMMU TLBI completion window remains open on iPhone 27.2
  (fix-gating gap, not a new memory-safety bug)
 2026-10-31 17:30:36 +08:00
JBJF 0288f2e3ae SPTM/MIE: hardware verification plans for GMMU TLBI race and tag-storage aliasing 2026-10-31 17:19:13 +08:00
JBJF f14f7df318 SPTM: function-level TLBI evidence (369 vs 264 insns, added completion wait) 2026-10-31 17:18:14 +08:00
JBJF 09a02858f6 SPTM/MIE deep dive: sptm.t8160 820.22 -> 820.40.24 (+64 KiB) 
- docs/SPTM-MIE-27.2.md: separate SPTM firmware changed (kernel __DATA_SPTM
  is not the monitor); new DART GAPF race, GMMU TLBI verification, iommu
  refcount, Dekker locks, hibernation handoff/latch checks; TXM build-only;
  Exclave +229 KB; MIE SK tag-page check unchanged (210 insns, relocated)
- candidate directions: DART unganged-GAPF race, hibernation handoff page
  count, SK tag-page aliasing, dangling tag storage; no working bypass
- correct the earlier claim that SPTM was unchanged
- tools: fw_diff, string_xref, func_string_diff
 2026-10-31 17:14:56 +08:00
JBJF 300d4805be docs: kernel CVE table — advisory impact vs binary evidence vs R/W potential 2026-10-31 17:10:40 +08:00
JBJF 6a77b43942 docs: complete iOS 27.2 advisory list (162 CVEs, 67 components) with binary candidates 2026-10-31 17:10:21 +08:00
JBJF 3ac5108928 iOS 27.2 kernel differential + NTL fix-boundary sweep 
- docs/IOS27.2-KERNEL-DIFF.md: 27.0.1 vs 27.2 (iPhone19,7), 162 advisory
  CVEs, 93 size-changed kexts; confirmed fix sites for 112705 (NTL 0..7
  assertion), 113910 (produced vs expected chunk bytes), 112507 (ipr/table
  NULL checks in ipc_misc.c); __DATA_SPTM byte-identical, no PPL/SPTM/MIE
  code change or bypass fix
- tools/ipsw/: Range-based IPSW reader, IM4P/LZFSE + fileset parser, kext
  extractor, llvm-objdump diff, advisory mapper
- CVE-2026-112705: --sweep mode (0..12, no frame) in both POCs; app module
  now sweeps 0/1/7/8/64/1024/16462/16463
- app 2.3 build 7
 2026-10-31 17:09:48 +08:00
JBJF 6f4ed67c38 112507 reachability closed: notification registration refused (-300) 
- New kern.ipc.lifecycle module: dead-name registration, dead-name send,
  notification receive, name reuse — single-threaded, safe on device
- Device receipt (iPhone19,7, iOS 27.0.1, ad-hoc signed): request DEAD_NAME
  returns -300 (MIG_TYPE_ERROR); send -> MACH_SEND_INVALID_DEST; receive
  times out; 0/12,288 registrations armed in kern.ipc
- macOS 27 sweep: 13 notification-type/right combinations, all -300
- kern.ipc now counts armed registrations and retracts the old 'survived'
  verdict when armed == 0; the request table is never armed
- docs/KERNEL-RW-ASSESSMENT.md: 112507 marked closed for this app
- app 2.2 build 5; 57 modules
 2026-10-31 15:59:20 +08:00
JBJF c30aadf9bb kernel R/W assessment for the high/critical entries 
- docs/KERNEL-RW-ASSESSMENT.md: per-primitive verdict. None of the six
  kernel-reachable bugs supplies both address and value control; the chain
  requirements (KASLR, grooming, reclaim, gadget, PAC/PPL) are listed per entry
- CVE-2026-113910.c: leak collector — 8 chunk configs x --loop, canonical
  pointer classification (kernel-text / kernel-data / kernel-other), --keep
  raw dump, --verbose; candidates are printed, never dereferenced
- 112705 / 65385 / 112696: explicit primitive-limit headers (DoS, fixed-offset
  write without leak, honest negative); no blind writes
- README: link the assessment and the new 113910 receipt (0 candidates, 16 runs)
 2026-10-31 15:37:58 +08:00