Compare commits
| Author | SHA1 | Date | |
|---|---|---|---|
 JBJF
|
fc17f7af7d | ||
|
JBJF
|
7da28702a7 | ||
|
JBJF
|
4ed0f0b304 | ||
|
JBJF
|
1cab5b2428 | ||
|
JBJF
|
9d6c44de61 | ||
|
JBJF
|
c7d4043a8c | ||
|
JBJF
|
6bb476a534 | ||
|
JBJF
|
8a8efdf15d | ||
|
JBJF
|
bdb029bb37 | ||
|
JBJF
|
0288f2e3ae | ||
|
JBJF
|
f14f7df318 | ||
|
JBJF
|
09a02858f6 | ||
|
JBJF
|
300d4805be | ||
|
JBJF
|
6a77b43942 |
No files matched your search
@@ -145,7 +145,7 @@ Kernel R/W feasibility for the high/critical entries is in [docs/KERNEL-RW-ASSES
|
||||
|
||||
112507 reachability was re-measured on the target (iPhone19,7, iOS 27.0.1) with the new `kern.ipc.lifecycle` module and an `armed` counter in `kern.ipc`: `mach_port_request_notification` returns -300 (MIG_TYPE_ERROR) for every type/right combination tried, 0 armed out of 12,288 registrations. The request table is never armed, so the race is not reachable from an unentitled app; the earlier "survived the interleaving" line is retracted. Details in [docs/KERNEL-RW-ASSESSMENT.md](docs/KERNEL-RW-ASSESSMENT.md).
|
||||
|
||||
**iOS 27.2 firmware diff (27.0.1 vs 27.2, iPhone19,7):** [docs/IOS27.2-KERNEL-DIFF.md](docs/IOS27.2-KERNEL-DIFF.md). The update carries 162 advisory CVEs; 93 of 303 common kexts changed text size. Confirmed fix sites: 112705 clamps `NumberOfTemporalLayers` to 0…7 (`iNumberOfTemporalLayers <= 7` assertion), 113910 adds `chunk %u produced %lld of %lld expected bytes`, 112507 adds `ipr != NULL` / `table != NULL` in `ipc_misc.c`. `__DATA_SPTM` is byte-identical across both builds; the PPL/SPTM/MIE string and code surface is unchanged, so no bypass for those three is fixed in 27.2.
|
||||
**iOS 27.2 firmware diff (27.0.1 vs 27.2, iPhone19,7):** [docs/IOS27.2-KERNEL-DIFF.md](docs/IOS27.2-KERNEL-DIFF.md). The update carries 162 advisory CVEs; 93 of 303 common kexts changed text size. Confirmed fix sites: 112705 clamps `NumberOfTemporalLayers` to 0…7 (`iNumberOfTemporalLayers <= 7` assertion), 113910 adds `chunk %u produced %lld of %lld expected bytes`, 112507 adds `ipr != NULL` / `table != NULL` in `ipc_misc.c`. The kernel's `__DATA_SPTM` segment is byte-identical, but the separate `sptm.t8160` firmware changed from SPTM-820.0.22 to **820.40.24** (+64 KiB: DART/IOMMU, TLBI and hibernation hardening, not in the CVE list). MIE/MTE policy in SPTM/XNU is unchanged. See [docs/SPTM-MIE-27.2.md](docs/SPTM-MIE-27.2.md) for the deep dive and candidate bypass directions.
|
||||
|
||||
## Module semantics
|
||||
|
||||
|
||||
+1
-1
@@ -144,7 +144,7 @@ armed 不是超时——是**死亡 oracle 命中**：负载触发进程崩溃
|
||||
|
||||
112507 的可达性已在目标机（iPhone19,7 / iOS 27.0.1）上用新增的 `kern.ipc.lifecycle` 模块与 `kern.ipc` 的 `armed` 计数重测：`mach_port_request_notification` 在所有类型/权限组合上都返回 -300（MIG_TYPE_ERROR），12,288 次注册 0 次成功。请求表从未被武装，因此无特权 app 触达不到该竞态；此前“活过交错”的结论撤回。详见 [docs/KERNEL-RW-ASSESSMENT.md](docs/KERNEL-RW-ASSESSMENT.md)。
|
||||
|
||||
**iOS 27.2 固件 diff（27.0.1 vs 27.2，iPhone19,7）：** [docs/IOS27.2-KERNEL-DIFF.md](docs/IOS27.2-KERNEL-DIFF.md)。本次更新含 162 条公告 CVE；303 个共有 kext 中 93 个 `__TEXT_EXEC` 尺寸变化。已确认的修复点：112705 把 `NumberOfTemporalLayers` 收紧到 0…7（断言 `iNumberOfTemporalLayers <= 7`），113910 新增 `chunk %u produced %lld of %lld expected bytes`，112507 在 `ipc_misc.c` 新增 `ipr != NULL` / `table != NULL`。`__DATA_SPTM` 两版字节完全一致，PPL/SPTM/MIE 的字符串与代码面没有变化 —— 27.2 没有修这三个 bypass。
|
||||
**iOS 27.2 固件 diff（27.0.1 vs 27.2，iPhone19,7）：** [docs/IOS27.2-KERNEL-DIFF.md](docs/IOS27.2-KERNEL-DIFF.md)。本次更新含 162 条公告 CVE；303 个共有 kext 中 93 个 `__TEXT_EXEC` 尺寸变化。已确认的修复点：112705 把 `NumberOfTemporalLayers` 收紧到 0…7（断言 `iNumberOfTemporalLayers <= 7`），113910 新增 `chunk %u produced %lld of %lld expected bytes`，112507 在 `ipc_misc.c` 新增 `ipr != NULL` / `table != NULL`。kernel 里的 `__DATA_SPTM` 段两版字节一致，但独立的 `sptm.t8160` 固件从 SPTM-820.0.22 升到 **820.40.24**（+64 KiB：DART/IOMMU、TLBI 与休眠加固，不在 CVE 列表里）。SPTM/XNU 的 MIE/MTE 策略没有变化。深度分析与候选 bypass 方向见 [docs/SPTM-MIE-27.2.md](docs/SPTM-MIE-27.2.md)。
|
||||
|
||||
## 模块语义
|
||||
|
||||
|
||||
@@ -0,0 +1,168 @@
|
||||
# iOS 27.2 advisory — all entries
|
||||
|
||||
162 CVEs across 67 components. Source: Apple security advisory 149230 (iOS 27.2 / iPadOS 27.2, 2026-10-26).
|
||||
|
||||
| CVE | Component | Impact | Description | Binary candidate |
|
||||
|---|---|---|---|---|
|
||||
| CVE-2026-112466 | AVEVideoEncoder | An app may be able to cause unexpected system termination or read kernel memory | An out-of-bounds read was addressed with improved input validation. | com.apple.driver.AppleAVE2 / VideoToolbox AVE plugin |
|
||||
| CVE-2026-112468 | AVEVideoEncoder | An app may be able to cause unexpected system termination or corrupt kernel memory | An out-of-bounds write issue was addressed with improved bounds checking. | com.apple.driver.AppleAVE2 / VideoToolbox AVE plugin |
|
||||
| CVE-2026-112469 | AVEVideoEncoder | An app may be able to cause unexpected system termination or corrupt kernel memory | An out-of-bounds write issue was addressed with improved bounds checking. | com.apple.driver.AppleAVE2 / VideoToolbox AVE plugin |
|
||||
| CVE-2026-112470 | AVEVideoEncoder | An app may be able to cause unexpected system termination or corrupt kernel memory | An out-of-bounds write issue was addressed with improved bounds checking. | com.apple.driver.AppleAVE2 / VideoToolbox AVE plugin |
|
||||
| CVE-2026-112689 | AVEVideoEncoder | An app may be able to cause unexpected system termination or corrupt kernel memory | An out-of-bounds write issue was addressed with improved input validation. | com.apple.driver.AppleAVE2 / VideoToolbox AVE plugin |
|
||||
| CVE-2026-112705 | AVEVideoEncoder | An app may be able to cause unexpected system termination | An out-of-bounds write issue was addressed with improved bounds checking. | com.apple.driver.AppleAVE2 / VideoToolbox AVE plugin |
|
||||
| CVE-2026-86971 | Accelerate Framework | Processing a maliciously crafted image may lead to unexpected app termination | An out-of-bounds write issue was addressed with improved bounds checking. | Accelerate |
|
||||
| CVE-2026-84493 | AccessorySetupKit | A malicious app may be able to access Bluetooth without user consent | An authentication issue was addressed with improved state management. | AccessorySetupKit |
|
||||
| CVE-2026-112446 | Accounts | An app may be able to access sensitive user data | This issue was addressed with additional entitlement checks. | Accounts |
|
||||
| CVE-2026-112612 | Accounts | An attacker with physical access to a trust-paired device may be able to read and write arbitrary files | A path handling issue was addressed with improved validation. | Accounts |
|
||||
| CVE-2026-113898 | Accounts | A malicious application may be able to bypass Privacy preferences | A logging issue was addressed with improved data redaction. | Accounts |
|
||||
| CVE-2026-112692 | App Intents | An app may be able to access sensitive user data | This issue was addressed with additional entitlement checks. | AppIntents |
|
||||
| CVE-2026-112690 | App Store | A remote attacker may be able to break out of the WebContent sandbox | This issue was addressed with improved input validation. | AppStore |
|
||||
| CVE-2026-113914 | App Store | An app may be able to access sensitive user data | An authorization issue was addressed with improved state management. | AppStore |
|
||||
| CVE-2026-86987 | Apple Intelligence | A remote attacker may be able to access sensitive user data | An authorization issue was addressed with improved entitlement checks. | AppleIntelligence |
|
||||
| CVE-2026-112696 | Apple Neural Engine | An app may be able to cause unexpected system termination or corrupt kernel memory | An out-of-bounds write issue was addressed with improved bounds checking. | AppleH16ANEInterface / AppleNeuralEngine.framework |
|
||||
| CVE-2026-84494 | Apple Neural Engine | An app may be able to cause unexpected system termination or write kernel memory | An out-of-bounds write issue was addressed with improved bounds checking. | AppleH16ANEInterface / AppleNeuralEngine.framework |
|
||||
| CVE-2026-112415 | AppleAVD | An app may be able to cause unexpected system termination or corrupt process memory | An out-of-bounds write was addressed with improved input validation. | ? |
|
||||
| CVE-2026-112416 | AppleAVD | Processing a maliciously crafted video file may lead to unexpected app termination | An out-of-bounds write issue was addressed with improved bounds checking. | ? |
|
||||
| CVE-2026-112454 | AppleAVD | Processing a maliciously crafted video file may lead to unexpected app termination or corrupt process memory | The issue was addressed with improved memory handling. | ? |
|
||||
| CVE-2026-112546 | Audio | Processing a maliciously crafted file may lead to unexpected app termination | An out-of-bounds read was addressed with improved bounds checking. | AudioToolbox / AudioCodecs |
|
||||
| CVE-2026-112566 | Bluetooth | An attacker in physical proximity may be able to cause a denial-of-service | A null pointer dereference was addressed with improved validation. | Bluetooth.framework / IOBluetooth kexts |
|
||||
| CVE-2026-113906 | Bluetooth | An attacker in physical proximity may be able to cause a denial-of-service | A null pointer dereference was addressed with improved validation. | Bluetooth.framework / IOBluetooth kexts |
|
||||
| CVE-2026-112619 | Calendar | Processing a maliciously crafted calendar invitation may lead to memory corruption | An out-of-bounds write issue was addressed with improved bounds checking. | CalendarFoundation |
|
||||
| CVE-2026-112678 | Calendar | An app may be able to access sensitive user data | A permissions issue was addressed with additional restrictions. | CalendarFoundation |
|
||||
| CVE-2026-112701 | CloudKit | An app may be able to access sensitive user data | An authorization issue was addressed with improved state management. | CloudKit |
|
||||
| CVE-2026-86988 | ColorSync | Processing a maliciously crafted image may result in disclosure of process memory | The issue was addressed with improved checks. | ColorSync |
|
||||
| CVE-2026-113910 | Compression | An app may be able to disclose kernel memory | A memory initialization issue was addressed with improved memory handling. | libcompression.dylib |
|
||||
| CVE-2026-113908 | Contacts | An app may be able to access sensitive user data | A privacy issue was addressed by removing sensitive data. | Contacts |
|
||||
| CVE-2026-112638 | CoreAudio | An attacker in radio range may be able to cause unexpected system termination | A heap buffer overflow was addressed with improved bounds checking. | CoreAudio.framework / AudioToolbox |
|
||||
| CVE-2026-113907 | CoreAudio | An app may be able to cause unexpected system termination or corrupt process memory | A buffer overflow issue was addressed with improved memory handling. | CoreAudio.framework / AudioToolbox |
|
||||
| CVE-2026-113912 | CoreAudio | Processing a maliciously crafted media file may lead to unexpected app termination or corrupt process memory | An out-of-bounds access issue was addressed with improved bounds checking. | CoreAudio.framework / AudioToolbox |
|
||||
| CVE-2026-86969 | CoreAudio | An app may be able to cause unexpected system termination or corrupt kernel memory | An out-of-bounds write was addressed with improved input validation. | CoreAudio.framework / AudioToolbox |
|
||||
| CVE-2026-86972 | CoreAudio | Processing a maliciously crafted audio file may lead to memory corruption | A buffer overflow was addressed with improved size validation. | CoreAudio.framework / AudioToolbox |
|
||||
| CVE-2026-112610 | CoreGraphics | Processing a maliciously crafted PDF file may lead to memory corruption | An out-of-bounds write issue was addressed with improved bounds checking. | CoreGraphics.framework |
|
||||
| CVE-2026-112611 | CoreGraphics | Processing a maliciously crafted PDF file may lead to memory corruption | An out-of-bounds write issue was addressed with improved bounds checking. | CoreGraphics.framework |
|
||||
| CVE-2026-113950 | CoreGraphics | Processing a maliciously crafted font may lead to unexpected app termination or corrupt process memory | An out-of-bounds write issue was addressed with improved bounds checking. | CoreGraphics.framework |
|
||||
| CVE-2026-112688 | CoreMedia | Parsing a file may lead to an unexpected app termination or arbitrary code execution | A memory corruption issue was addressed with improved memory handling. | CoreMedia.framework / mediaplaybackd |
|
||||
| CVE-2026-112706 | CoreMedia | An app may be able to access sensitive user data | A permissions issue was addressed with additional restrictions. | CoreMedia.framework / mediaplaybackd |
|
||||
| CVE-2026-86990 | CoreMedia | A malicious app may be able to access the camera without user permission | An access issue was addressed with improved access restrictions. | CoreMedia.framework / mediaplaybackd |
|
||||
| CVE-2026-86992 | CoreMedia | Processing a maliciously crafted video file may lead to unexpected app termination | The issue was addressed with improved memory handling. | CoreMedia.framework / mediaplaybackd |
|
||||
| CVE-2026-112656 | CoreText | Processing a maliciously crafted font may result in the disclosure of process memory | An out-of-bounds read was addressed with improved bounds checking. | CoreText.framework |
|
||||
| CVE-2026-113896 | FileProvider | An app may be able to access sensitive user data | A race condition was addressed with additional validation. | FileProvider |
|
||||
| CVE-2026-112618 | Files | An app may be able to access sensitive user data | An access issue was addressed with improved access restrictions. | Files |
|
||||
| CVE-2026-112432 | FontParser | An app may be able to access sensitive user data | A logging issue was addressed with improved data redaction. | FontParser.framework |
|
||||
| CVE-2026-112642 | FontParser | Processing a maliciously crafted font may result in the disclosure of process memory | An out-of-bounds read was addressed with improved bounds checking. | FontParser.framework |
|
||||
| CVE-2026-112683 | FontParser | Processing a maliciously crafted font may lead to unexpected app termination or corrupt process memory | An out-of-bounds write issue was addressed with improved bounds checking. | FontParser.framework |
|
||||
| CVE-2026-86970 | FontParser | Processing a maliciously crafted font may result in the disclosure of process memory | An out-of-bounds read was addressed with improved input validation. | FontParser.framework |
|
||||
| CVE-2026-112456 | HFS | Processing a maliciously crafted file may lead to heap corruption | An out-of-bounds write issue was addressed with improved input validation. | com.apple.filesystems.hfs.kext |
|
||||
| CVE-2026-112518 | Heimdal | An attacker in a privileged network position may be able to impersonate a Kerberos KDC | An issue with signature validation was addressed with improved checks. | Heimdal (Kerberos) |
|
||||
| CVE-2026-112596 | HomeKit | Processing a maliciously crafted video file may lead to unexpected system termination | An integer overflow was addressed with improved bounds checking. | HomeKit |
|
||||
| CVE-2026-86978 | HomeKit | An app may be able to access sensitive user data | This issue was addressed with improved checks. | HomeKit |
|
||||
| CVE-2026-112515 | IOHIDFamily | An attacker may be able to cause unexpected system termination or read kernel memory | An out-of-bounds read was addressed with improved bounds checking. | com.apple.iokit.IOHIDFamily |
|
||||
| CVE-2026-65385 | IOKit | A buffer overflow may result in memory corruption and unexpected app termination | An out-of-bounds write issue was addressed with improved bounds checking. | IOKit.framework / IOKit kexts |
|
||||
| CVE-2026-112459 | IOMobileFrameBuffer | An app may be able to cause unexpected system termination or corrupt kernel memory | A race condition was addressed with improved state handling. | com.apple.driver.IOMobileFrameBuffer |
|
||||
| CVE-2026-112554 | IOStorageFamily | An app may be able to cause unexpected system termination or read kernel memory | An out-of-bounds read was addressed with improved bounds checking. | com.apple.iokit.IOStorageFamily |
|
||||
| CVE-2026-112477 | IOSurface | An app may be able to cause unexpected system termination or corrupt kernel memory | A race condition was addressed with improved locking. | IOSurface.framework / IOSurface kext |
|
||||
| CVE-2026-112488 | ImageIO | Processing a maliciously crafted image may corrupt process memory | A buffer overflow issue was addressed with improved memory handling. | ImageIO.framework |
|
||||
| CVE-2026-112561 | ImageIO | Processing a maliciously crafted image may result in disclosure of process memory | An out-of-bounds read was addressed with improved bounds checking. | ImageIO.framework |
|
||||
| CVE-2026-112571 | ImageIO | Processing a maliciously crafted image may result in disclosure of process memory | A memory initialization issue was addressed with improved memory handling. | ImageIO.framework |
|
||||
| CVE-2026-112614 | ImageIO | Processing a maliciously crafted image may lead to unexpected app termination | An out-of-bounds write issue was addressed with improved bounds checking. | ImageIO.framework |
|
||||
| CVE-2026-112625 | ImageIO | Processing a maliciously crafted image may result in memory corruption | An integer underflow was addressed with improved input validation. | ImageIO.framework |
|
||||
| CVE-2026-112627 | ImageIO | Processing a maliciously crafted image may result in disclosure of process memory | An out-of-bounds read was addressed with improved bounds checking. | ImageIO.framework |
|
||||
| CVE-2026-112629 | ImageIO | Processing a maliciously crafted image may lead to unexpected app termination | An out-of-bounds read was addressed with improved bounds checking. | ImageIO.framework |
|
||||
| CVE-2026-112630 | ImageIO | Processing a maliciously crafted image may result in disclosure of process memory | An uninitialized memory issue was addressed with improved memory handling. | ImageIO.framework |
|
||||
| CVE-2026-112632 | ImageIO | Processing a maliciously crafted image may result in disclosure of process memory | An uninitialized memory issue was addressed with improved memory handling. | ImageIO.framework |
|
||||
| CVE-2026-112633 | ImageIO | Processing a maliciously crafted image may lead to unexpected app termination | An out-of-bounds write issue was addressed with improved bounds checking. | ImageIO.framework |
|
||||
| CVE-2026-112634 | ImageIO | Processing a maliciously crafted image may lead to unexpected app termination | An out-of-bounds read was addressed with improved bounds checking. | ImageIO.framework |
|
||||
| CVE-2026-112474 | Kernel | An app may be able to cause unexpected system termination or write kernel memory | A use-after-free issue was addressed with improved memory management. | kernelcache core (pmap/ipc/vm/bsd) |
|
||||
| CVE-2026-112476 | Kernel | An app may be able to cause unexpected system termination | An out-of-bounds read was addressed with improved bounds checking. | kernelcache core (pmap/ipc/vm/bsd) |
|
||||
| CVE-2026-112501 | Kernel | An app may be able to cause unexpected system termination | A race condition was addressed with improved state handling. | kernelcache core (pmap/ipc/vm/bsd) |
|
||||
| CVE-2026-112507 | Kernel | An app may be able to cause unexpected system termination or write kernel memory | An out-of-bounds write issue was addressed with improved bounds checking. | kernelcache core (pmap/ipc/vm/bsd) |
|
||||
| CVE-2026-112514 | Kernel | An attacker may be able to cause unexpected system termination or corrupt kernel memory | A use-after-free issue was addressed with improved memory management. | kernelcache core (pmap/ipc/vm/bsd) |
|
||||
| CVE-2026-112516 | Kernel | An app may be able to cause unexpected system termination | A use-after-free issue was addressed with improved memory management. | kernelcache core (pmap/ipc/vm/bsd) |
|
||||
| CVE-2026-112517 | Kernel | An app may be able to cause unexpected system termination or corrupt kernel memory | A use after free issue was addressed with improved memory management. | kernelcache core (pmap/ipc/vm/bsd) |
|
||||
| CVE-2026-112576 | Kernel | An app may be able to cause unexpected changes to copy-on-write memory | A memory integrity issue was addressed with improved handling of copy-on-write pages. | kernelcache core (pmap/ipc/vm/bsd) |
|
||||
| CVE-2026-112606 | Kernel | An app may be able to cause unexpected system termination | A type confusion issue was addressed with improved memory handling. | kernelcache core (pmap/ipc/vm/bsd) |
|
||||
| CVE-2026-112624 | Kernel | An app may be able to bypass Privacy preferences | This issue was addressed with improved checks. | kernelcache core (pmap/ipc/vm/bsd) |
|
||||
| CVE-2026-112665 | Kernel | An app may be able to determine kernel memory layout | An information disclosure issue was addressed with improved state management. | kernelcache core (pmap/ipc/vm/bsd) |
|
||||
| CVE-2026-112679 | Kernel | An app may be able to cause unexpected system termination or corrupt kernel memory | A use-after-free issue was addressed with improved memory management. | kernelcache core (pmap/ipc/vm/bsd) |
|
||||
| CVE-2026-112698 | Kernel | An app may be able to cause unexpected system termination | The issue was addressed with improved memory handling. | kernelcache core (pmap/ipc/vm/bsd) |
|
||||
| CVE-2026-65350 | Kernel | An app may be able to cause unexpected system termination or corrupt kernel memory | A use-after-free issue was addressed with improved memory management. | kernelcache core (pmap/ipc/vm/bsd) |
|
||||
| CVE-2026-84495 | Kernel | An app may be able to cause unexpected system termination or write kernel memory | A use-after-free issue was addressed with improved memory management. | kernelcache core (pmap/ipc/vm/bsd) |
|
||||
| CVE-2026-112621 | LinkPresentation | Processing a maliciously crafted image may result in memory corruption | An out-of-bounds write issue was addressed with improved bounds checking. | LinkPresentation.framework |
|
||||
| CVE-2026-112414 | Mail | Processing a maliciously crafted message may lead to a denial-of-service | A stack overflow was addressed with improved input validation. | Mail |
|
||||
| CVE-2026-112671 | Mail | A remote attacker may be able to cause a denial-of-service | A resource exhaustion issue was addressed with improved input validation. | Mail |
|
||||
| CVE-2026-112707 | Maps | An app may be able to identify what other apps a user has installed | A privacy issue was addressed by moving sensitive data to a protected location. | Maps |
|
||||
| CVE-2026-113915 | MediaAnalysis | An app may be able to access sensitive user data | A race condition was addressed with additional validation. | MediaAnalysis |
|
||||
| CVE-2026-112687 | MediaRemote | An attacker on the local network may be able to cause unexpected system termination or corrupt process memory | This issue was addressed by removing the vulnerable code. | MediaRemote |
|
||||
| CVE-2026-112682 | Messages | A remote attacker may be able to cause unexpected app termination | An input validation issue was addressed with improved input validation. | Messages / IMSharedUtilities |
|
||||
| CVE-2026-86989 | MobileGestalt | An app may be able to fingerprint the user | An authorization issue was addressed with improved state management. | MobileGestalt |
|
||||
| CVE-2026-112413 | Model I/O | Processing a maliciously crafted file may lead to unexpected app termination | An out-of-bounds read was addressed with improved bounds checking. | ? |
|
||||
| CVE-2026-112449 | Model I/O | Processing a maliciously crafted 3D model may lead to memory corruption | An integer overflow was addressed with improved input validation. | ? |
|
||||
| CVE-2026-112461 | Model I/O | Processing a maliciously crafted 3D model may lead to memory corruption | An out-of-bounds write issue was addressed with improved bounds checking. | ? |
|
||||
| CVE-2026-112485 | Model I/O | Processing a maliciously crafted 3D model may lead to memory corruption | The issue was addressed with improved memory handling. | ? |
|
||||
| CVE-2026-112486 | Model I/O | Processing a 3D model may lead to unexpected app termination | An out-of-bounds write issue was addressed with improved bounds checking. | ? |
|
||||
| CVE-2026-112565 | Model I/O | Processing a maliciously crafted 3D model may lead to memory corruption | An integer overflow was addressed with improved input validation. | ? |
|
||||
| CVE-2026-112660 | Photos Storage | An app may be able to bypass certain Privacy preferences | An authorization issue was addressed with improved state management. | Photos |
|
||||
| CVE-2026-112676 | Photos Storage | An app may be able to access a user's Photos Library | This issue was addressed with additional entitlement checks. | Photos |
|
||||
| CVE-2026-65397 | Photos Storage | An app may be able to access sensitive user data | An authorization issue was addressed with improved state management. | Photos |
|
||||
| CVE-2026-112681 | Power Management | An app may be able to fingerprint the user | This issue was addressed with additional entitlement checks. | com.apple.driver.AppleARMPlatform / PM kexts |
|
||||
| CVE-2026-86925 | Quick Look | An app may be able to access sensitive user data | An authorization issue was addressed with improved state management. | QuickLook |
|
||||
| CVE-2026-112491 | RealityKit | Processing a maliciously crafted file may lead to unexpected app termination | An out-of-bounds read was addressed with improved bounds checking. | RealityKit |
|
||||
| CVE-2026-112547 | ReplayKit | An app may be able to access sensitive user data | A type confusion issue was addressed with improved checks. | ReplayKit |
|
||||
| CVE-2026-112609 | Safety Check | An app may be able to access sensitive user data | This issue was addressed with improved checks. | SafetyCheck |
|
||||
| CVE-2026-112423 | SceneKit | Processing a maliciously crafted file may lead to a denial-of-service or potentially disclose memory contents | An out-of-bounds read was addressed with improved bounds checking. | SceneKit |
|
||||
| CVE-2026-112425 | SceneKit | Processing a 3D model may result in disclosure of process memory | An out-of-bounds read was addressed with improved bounds checking. | SceneKit |
|
||||
| CVE-2026-112464 | SceneKit | Processing a maliciously crafted file may lead to heap corruption | An out-of-bounds write issue was addressed with improved input validation. | SceneKit |
|
||||
| CVE-2026-86991 | SceneKit | Processing a maliciously crafted file may lead to unexpected process termination | A buffer overflow was addressed with improved bounds checking. | SceneKit |
|
||||
| CVE-2026-112616 | Screen Time | An app may be able to access sensitive user data | An authorization issue was addressed with improved access control. | ScreenTime |
|
||||
| CVE-2026-112652 | Security | An malicious app may be able to bypass certificate validation | A logic issue was addressed with improved state management. | Security.framework |
|
||||
| CVE-2026-113913 | Security | Processing web content may disclose sensitive information | An input validation issue was addressed with improved input validation. | Security.framework |
|
||||
| CVE-2026-112455 | Shortcuts | An app may be able to access sensitive user data | An authorization issue was addressed with improved state management. | Shortcuts |
|
||||
| CVE-2026-112559 | Shortcuts | An app may be able to access sensitive user data | An authorization issue was addressed with improved state management. | Shortcuts |
|
||||
| CVE-2026-112658 | Siri | An app may be able to access sensitive user data | This issue was addressed with improved input validation. | Siri |
|
||||
| CVE-2026-112685 | Siri | An app may be able to access sensitive user data | An authorization issue was addressed with improved state management. | Siri |
|
||||
| CVE-2022-26704 | Spotlight | An app may be able to gain elevated privileges | A validation issue existed in the handling of symlinks. This issue was addressed with improved validation of symlinks. | Spotlight |
|
||||
| CVE-2026-112567 | Spotlight | A malicious application may be able to bypass Privacy preferences | This issue was addressed with improved checks. | Spotlight |
|
||||
| CVE-2026-112628 | Spotlight | An app may be able to access sensitive user data | This issue was addressed with improved data access restriction. | Spotlight |
|
||||
| CVE-2026-112646 | SpringBoard | An app may be able to cause unexpected system termination or corrupt process memory | An out-of-bounds write issue was addressed with improved bounds checking. | SpringBoard |
|
||||
| CVE-2026-112691 | SwiftUI | An app may be able to cause unexpected system termination | An out-of-bounds write issue was addressed with improved input validation. | SwiftUI |
|
||||
| CVE-2026-86968 | System Preferences | A malicious app may be able to access restricted system interfaces or launder launch attribution | An access issue was addressed with improved access control. | SystemPreferences |
|
||||
| CVE-2026-84605 | TextKit | An app may be able to read the device's name | An authorization issue was addressed with improved state management. | TextKit |
|
||||
| CVE-2026-112595 | Thread | An attacker in physical proximity may be able to craft malicious network traffic to gain access to a Thread network | This issue was addressed with improved authentication. | ThreadNetwork.framework |
|
||||
| CVE-2026-112479 | USB | A malicious USB device may be able to cause unexpected system termination or read kernel memory | An out-of-bounds read was addressed with improved bounds checking. | USB kexts |
|
||||
| CVE-2026-112599 | WebKit | Processing maliciously crafted web content may lead to an unexpected process crash | A use-after-free issue was addressed with improved memory management. | JavaScriptCore / WebKit / WebCore |
|
||||
| CVE-2026-112615 | WebKit | Processing maliciously crafted web content may lead to an unexpected process termination | A use-after-free issue was addressed with improved memory management. | JavaScriptCore / WebKit / WebCore |
|
||||
| CVE-2026-112623 | WebKit | Processing maliciously crafted web content may lead to arbitrary code execution | A use-after-free issue was addressed with improved memory management. | JavaScriptCore / WebKit / WebCore |
|
||||
| CVE-2026-112640 | WebKit | Processing maliciously crafted web content may lead to memory corruption | A use-after-free issue was addressed with improved memory management. | JavaScriptCore / WebKit / WebCore |
|
||||
| CVE-2026-112651 | WebKit | Processing maliciously crafted web content may lead to arbitrary code execution | A use-after-free issue was addressed with improved memory management. | JavaScriptCore / WebKit / WebCore |
|
||||
| CVE-2026-112653 | WebKit | Processing maliciously crafted web content may lead to an unexpected process termination | A use-after-free issue was addressed with improved memory management. | JavaScriptCore / WebKit / WebCore |
|
||||
| CVE-2026-112654 | WebKit | Processing maliciously crafted web content may lead to an unexpected process termination | A use-after-free issue was addressed with improved memory management. | JavaScriptCore / WebKit / WebCore |
|
||||
| CVE-2026-112655 | WebKit | Processing maliciously crafted web content may lead to arbitrary code execution | A use-after-free issue was addressed with improved memory management. | JavaScriptCore / WebKit / WebCore |
|
||||
| CVE-2026-112659 | WebKit | Processing maliciously crafted web content may lead to arbitrary code execution | A type confusion issue was addressed with improved memory handling. | JavaScriptCore / WebKit / WebCore |
|
||||
| CVE-2026-112666 | WebKit | Processing maliciously crafted web content may lead to an unexpected process termination | A use-after-free issue was addressed with improved memory management. | JavaScriptCore / WebKit / WebCore |
|
||||
| CVE-2026-112669 | WebKit | Processing maliciously crafted web content may lead to an unexpected Safari crash | A race condition was addressed with improved state handling. | JavaScriptCore / WebKit / WebCore |
|
||||
| CVE-2026-112673 | WebKit | Processing maliciously crafted web content may lead to an unexpected process termination | A type confusion issue was addressed with improved state handling. | JavaScriptCore / WebKit / WebCore |
|
||||
| CVE-2026-112680 | WebKit | Processing maliciously crafted web content may result in the disclosure of process memory | An out-of-bounds read was addressed with improved bounds checking. | JavaScriptCore / WebKit / WebCore |
|
||||
| CVE-2026-112684 | WebKit | Processing maliciously crafted web content may lead to an unexpected process crash | This issue was addressed through improved state management. | JavaScriptCore / WebKit / WebCore |
|
||||
| CVE-2026-112686 | WebKit | Processing maliciously crafted web content may lead to an unexpected process termination | A race condition was addressed with improved locking. | JavaScriptCore / WebKit / WebCore |
|
||||
| CVE-2026-112693 | WebKit | Processing maliciously crafted web content may lead to an unexpected Safari crash | A use-after-free issue was addressed with improved memory management. | JavaScriptCore / WebKit / WebCore |
|
||||
| CVE-2026-112695 | WebKit | Processing maliciously crafted web content may lead to an unexpected process termination | A use-after-free issue was addressed with improved memory management. | JavaScriptCore / WebKit / WebCore |
|
||||
| CVE-2026-112697 | WebKit | Processing maliciously crafted web content may lead to arbitrary code execution | A use-after-free issue was addressed with improved memory management. | JavaScriptCore / WebKit / WebCore |
|
||||
| CVE-2026-112699 | WebKit | Processing maliciously crafted web content may result in the disclosure of process memory | An out-of-bounds read was addressed with improved bounds checking. | JavaScriptCore / WebKit / WebCore |
|
||||
| CVE-2026-113903 | WebKit | Processing maliciously crafted web content may lead to unexpected memory modification | A use-after-free issue was addressed with improved memory management. | JavaScriptCore / WebKit / WebCore |
|
||||
| CVE-2026-113904 | WebKit | Processing maliciously crafted web content may lead to an unexpected process crash | A use-after-free issue was addressed with improved memory management. | JavaScriptCore / WebKit / WebCore |
|
||||
| CVE-2026-113949 | WebKit | Processing maliciously crafted web content may lead to memory corruption | A type confusion issue was addressed with improved state management. | JavaScriptCore / WebKit / WebCore |
|
||||
| CVE-2026-113952 | WebKit | A website may be able to use a media format that should be restricted in Lockdown Mode | A logic issue was addressed with improved checks. | JavaScriptCore / WebKit / WebCore |
|
||||
| CVE-2026-86974 | WebKit | Processing maliciously crafted web content may lead to memory corruption | A type confusion issue was addressed with improved checks. | JavaScriptCore / WebKit / WebCore |
|
||||
| CVE-2026-86985 | WebKit | Processing maliciously crafted web content may lead to an unexpected process crash | This issue was addressed with improved input validation. | JavaScriptCore / WebKit / WebCore |
|
||||
| CVE-2026-86986 | WebKit | Processing maliciously crafted web content may lead to an unexpected Safari crash | A use-after-free issue was addressed with improved memory management. | JavaScriptCore / WebKit / WebCore |
|
||||
| CVE-2026-112637 | WebKit Canvas | Processing maliciously crafted web content may lead to arbitrary code execution | A use-after-free issue was addressed with improved memory management. | WebCore (canvas) |
|
||||
| CVE-2026-112626 | WebKit JavaScript Bindings | Processing maliciously crafted web content may lead to arbitrary code execution | A use-after-free issue was addressed with improved memory management. | JavaScriptCore bindings |
|
||||
| CVE-2026-112639 | WebKit Process Model | Processing maliciously crafted web content may lead to arbitrary code execution | A use-after-free issue was addressed with improved memory management. | WebKit process model |
|
||||
| CVE-2026-113897 | WebKit Process Model | A remote attacker may be able to break out of Web Content sandbox | This issue was addressed by removing the vulnerable code. | WebKit process model |
|
||||
| CVE-2026-113901 | WebRTC | Processing maliciously crafted web content may lead to an unexpected process crash | A use-after-free issue was addressed with improved memory management. | WebRTC.framework |
|
||||
| CVE-2026-86973 | WebRTC | Processing maliciously crafted web content may lead to an unexpected process crash | An out-of-bounds read was addressed with improved bounds checking. | WebRTC.framework |
|
||||
| CVE-2026-112620 | Wi-Fi | An attacker in a privileged network position may be able to cause a denial-of-service | A denial-of-service issue was addressed with improved input validation. | WiFi frameworks / IO80211 kext |
|
||||
| CVE-2026-112622 | Wi-Fi | An attacker in radio range may be able to cause unexpected system termination | An out-of-bounds read was addressed with improved bounds checking. | WiFi frameworks / IO80211 kext |
|
||||
| CVE-2026-113909 | Wi-Fi | An attacker in physical proximity may be able to corrupt process memory | A memory corruption issue was addressed with improved input validation. | WiFi frameworks / IO80211 kext |
|
||||
| CVE-2026-112522 | libarchive | Processing a maliciously crafted file may lead to unexpected app termination | An out-of-bounds write issue was addressed with improved bounds checking. | libarchive.2.dylib |
|
||||
| CVE-2026-112607 | mDNSResponder | A remote attacker may be able to leak memory | An out-of-bounds read was addressed with improved bounds checking. | mDNSResponder |
|
||||
+44
-23
@@ -20,11 +20,15 @@ analysis did not wait for the full 26 GB. The container is IM4P; the payload is
|
||||
| Build | Kernelcache (decoded) | SHA-256 (first 16) |
|
||||
|---|---|---|
|
||||
| 27.0.1 | 78,315,520 B | `dec73956a9a443c5` |
|
||||
| 27.2 | 79,167,488 B | `9a6efbc4be67319a` |
|
||||
| 27.2 (v6x-pandia) | 78,675,968 B | `1aaf47dbc73650e3` |
|
||||
|
||||
Both are `MH_FILESET` images with a `__DATA_SPTM` segment, carrying 303 (27.0.1) and
|
||||
305 (27.2) fileset entries. Two kexts are new: `com.apple.driver.ApplePencilDriver`,
|
||||
`com.apple.iokit.AppleSecurityResearch`; none were removed.
|
||||
Both are `MH_FILESET` images with a `__DATA_SPTM` segment, carrying 303 (27.0.1)
|
||||
and 304 (27.2) fileset entries. One kext is new: `com.apple.driver.ApplePencilDriver`;
|
||||
none were removed.
|
||||
|
||||
27.2 ships three kernelcaches (`v63`, `v64`, `v6x-pandia`); iPhone19,7 uses
|
||||
`v6x-pandia` (member SHA-256 `0777eb09…`). The numbers and addresses below are
|
||||
from that member, not from the first kernelcache in the ZIP.
|
||||
|
||||
## Reading the diff
|
||||
|
||||
@@ -36,7 +40,7 @@ code is unchanged. The diff therefore keys on:
|
||||
2. `__cstring` / `__oslogstring` set difference (new checks usually add a message),
|
||||
3. `llvm-objdump` instruction diff for the kexts that survive both filters.
|
||||
|
||||
93 of 303 common kexts changed text size. The largest are the ones the advisory
|
||||
93 of 303 common kexts changed text size (v6x-pandia). The largest are the ones the advisory
|
||||
points at:
|
||||
|
||||
| Delta | Kext | Advisory component |
|
||||
@@ -126,26 +130,43 @@ per-CVE signature.
|
||||
|
||||
## PPL / SPTM / MIE
|
||||
|
||||
This is the part the request specifically asked to dig into.
|
||||
**Correction:** the kernel's `__DATA_SPTM` segment is byte-identical (311,296 B,
|
||||
same SHA), but SPTM is a separate firmware image and **did** change:
|
||||
|
||||
- `__DATA_SPTM` is **byte-identical** in both builds: 311,296 bytes, SHA-256
|
||||
`f4bc1e5e95f61af5…`. No SPTM code or data changed.
|
||||
- The PPL token strings (`UAT_PPL_IOCTL_*`, `PPL map operation failed`,
|
||||
`PPL state object`) are unchanged; no new PPL checks or messages.
|
||||
- No MIE / Memory Integrity / mtag / page-protection strings were added or removed.
|
||||
- The only SPTM-related additions are boot-time memory-size validation:
|
||||
`memsize=%u MB leaves no memory for XNU/SPTM to manage`, `Mismatch of
|
||||
ARM_LARGE_MEMORY in SPTM/XNU`, and iBoot DRAM-size checks. These are
|
||||
configuration checks, not a permission bypass.
|
||||
- The 27.2 advisory contains no component named PPL, SPTM, MIE, or Page Protection,
|
||||
and no CVE description mentions them.
|
||||
- `Firmware/sptm.t8160`: SPTM-820.0.22 → **SPTM-820.40.24**, 1,261,600 → 1,327,136 B
|
||||
(+64 KiB, all in `__LATE_CONST`); `__TEXT_EXEC` same size, different hash.
|
||||
- New checks: DART `VIOLATION_T8110_DART_UNGANG_GAPF_RACE`, GMMU TLBI
|
||||
verification, IOMMU read-refcount validation, UAT Dekker lock timeouts,
|
||||
`VIOLATION_NVME_ILLEGAL_HIBERNATION_QUEUE_LATCH`, hibernation handoff page count.
|
||||
- `txm.iphoneos`: same size, build-path/version only (Image4 374~7022 → 374~8637).
|
||||
- `exclavecore`: 33,259,754 → 33,489,130 B (+229,376) — separate domain.
|
||||
- MIE/MTE policy in SPTM is unchanged: the `MTE tag page containing SK tags`
|
||||
check is a 210-instruction function in both builds (relocated, same shape), and
|
||||
the kernel's MTE strings are identical. The Exclave image changed separately.
|
||||
|
||||
**Verdict: no PPL, SPTM, or MIE bypass is fixed in iOS 27.2, and the firmware diff
|
||||
shows no change in the SPTM/PPL/MIE code paths.** A bypass PoC for any of the three
|
||||
would have to come from a different bug, not from this update. The kernel CVEs with
|
||||
"write kernel memory" impacts are ordinary kernel memory-safety bugs; none of them
|
||||
is a page-table / monitor bypass on its own, and exploiting one would still have to
|
||||
defeat SPTM/PPL/MIE at runtime.
|
||||
The full analysis, function addresses, and candidate bypass directions (DART
|
||||
GAPF race, hibernation handoff, SK tag-page aliasing, dangling tag storage) are in
|
||||
[SPTM-MIE-27.2.md](SPTM-MIE-27.2.md). No working SPTM/MIE bypass was produced: the
|
||||
27.2 changes add checks, and the candidate paths need a reachable primitive that
|
||||
the diff does not contain.
|
||||
|
||||
## Kernel fix-site candidates (27.2, address in the final 24B119 kernelcache)
|
||||
|
||||
These are the functions that reference the new 27.2 strings. They are candidate
|
||||
fix sites for the 15 Kernel CVEs; the advisory does not map a CVE to a function,
|
||||
so treat the CVE attribution as an inference.
|
||||
|
||||
| New string | Function (27.2) | Likely area |
|
||||
|---|---|---|
|
||||
| `size <= sdl->sdl_alen` | `0xfffffe000aeee474` (assert at `0xfffffe000aeee74c`) | sockaddr_dl / ifaddr bounds (info leak candidate, cf. 112665) |
|
||||
| `Failed mbuf validity check` | `0xfffffe000aeaf8ac`, `0xfffffe000aecee70`, `0xfffffe000b0161bc`, `0xfffffe000b0c17a0` | mbuf length vs off+len (OOB read/write candidate) |
|
||||
| `VM entry %p lock shared lock overflow` | `0xfffffe000b4bad74` | vm_map shared-lock state (COW / 112576 candidate) |
|
||||
| `Page modified after framebank withdraw %p` | `0xfffffe000ad831b8` | pmap page lifecycle (UAF candidate) |
|
||||
|
||||
The `sdl` site is the most user-reachable of the four: it is on the network
|
||||
interface/address path and the string is an assertion added in 27.2. The mbuf
|
||||
site is next. Neither has a trigger or a demonstrated R/W effect; they are the
|
||||
next functions to audit with a device.
|
||||
|
||||
## What can be turned into a PoC
|
||||
|
||||
|
||||
@@ -0,0 +1,338 @@
|
||||
# SPTM / MIE deep dive — iOS 27.2 (24B119) vs 27.0.1 (24A446)
|
||||
|
||||
This is the part that the kernelcache alone cannot answer. SPTM is a separate
|
||||
firmware image in the IPSW (`Firmware/sptm.t8160.release.im4p`), and it **did**
|
||||
change in 27.2. The earlier note that "SPTM is unchanged" was based only on the
|
||||
kernel's `__DATA_SPTM` segment and was wrong: that segment is identical, but the
|
||||
SPTM monitor itself is not.
|
||||
|
||||
## Component inventory
|
||||
|
||||
| Component | 27.0.1 | 27.2 | Change |
|
||||
|---|---|---|---|
|
||||
| `sptm.t8160` | 1,261,600 B · SPTM-820.0.22 | 1,327,136 B · SPTM-820.40.24 | **+65,536 B** |
|
||||
| `txm.iphoneos` | 557,088 B · Image4 374~7022 | 557,088 B · Image4 374~8637 | build-only |
|
||||
| `exclavecore.t8160` | 33,259,754 B | 33,489,130 B | +229,376 B |
|
||||
| kernel `__DATA_SPTM` | 311,296 B · sha f4bc1e5e… | 311,296 B · sha f4bc1e5e… | **identical** |
|
||||
| kernel MTE strings | `VM_KERN_MEMORY_MTAG`, taggable pages | same | unchanged |
|
||||
|
||||
SPTM segment sizes:
|
||||
|
||||
| Segment | 27.0.1 | 27.2 |
|
||||
|---|---|---|
|
||||
| `__TEXT_EXEC` | 425,984 | 425,984 |
|
||||
| `__LATE_CONST` | 524,288 | **589,824** (+65,536) |
|
||||
| `__TEXT` / `__DATA` / `__BOOTDATA` | 98,304 / 65,536 / 98,304 | same |
|
||||
|
||||
The +64 KiB is entirely in `__LATE_CONST`; the executable text kept its size but
|
||||
its hash changed (`347aa218…` → `064c286f…`), so functions were edited/relocated.
|
||||
|
||||
## What 27.2 adds to SPTM
|
||||
|
||||
String diff (32 new, 7 removed) is dominated by IOMMU/DART and hibernation
|
||||
hardening — none of it is named in the 162-CVE advisory:
|
||||
|
||||
- `VIOLATION_T8110_DART_UNGANG_GAPF_RACE`
|
||||
- `%s: %s: iommu_read_refcnt (0x%hhx) > read_refcnt(0x%x) for FTE %p`
|
||||
- `%s: Failed to verify TLBI`
|
||||
- `%s: The GMMU TLBI verification register should be 8B-aligned`
|
||||
- `gmmu-tlbi-verification-reg` / `gmmu-tlbi-verification-bit`
|
||||
- `%s: UAT Dekker gate acquisition timed out after %llu ns`
|
||||
- `%s: UAT Dekker lock acquisition timed out after %llu ns`
|
||||
- `%s: dart %p (%s:%u): relaxed_rw_protections and allow_pte_remap are not supported together`
|
||||
- `%s: dart %p (%s:%u): Inconsistent unganged clock protection configuration`
|
||||
- `VIOLATION_NVME_ILLEGAL_HIBERNATION_QUEUE_LATCH`
|
||||
- `hib_header_copy->handoffPageCount < HIB_HANDOFF_PAGECOUNT_LIMIT`
|
||||
- `sptm_allow_vm_isa_internal_guests`, `sptm_is_iuou_or_iuos_device`
|
||||
- `SPTM-820.40.24|2026-10-03:14:50:35`
|
||||
|
||||
The TLBI string has five code xrefs in 27.2, at functions starting near
|
||||
`0xfffffff0270c7aac`, `0xfffffff0270c85f8`, `0xfffffff0270c987c`,
|
||||
`0xfffffff0270cacf4` and `0xfffffff027109940`.
|
||||
|
||||
Function-level alignment makes the change concrete. The first TLBI function
|
||||
(`0xfffffff0270c7aac`, **369 instructions**) matches a **264-instruction**
|
||||
function at `0xfffffff0270b7a90` in 27.0.1 (prefix similarity 0.90). The 27.2
|
||||
version inserts a block that:
|
||||
|
||||
1. reads `DAIF` and masks interrupts (`msr DAIFSet, #0x7`, `dsb sy`);
|
||||
2. reads `CNTVCTSS_EL0` and `CNTFRQ_EL0` and computes a deadline;
|
||||
3. loads a timeout constant (`0x3d40` = 15680 units) and the TLBI verification
|
||||
register address;
|
||||
4. polls/validates the GMMU TLBI completion, and only then continues.
|
||||
|
||||
The 27.0.1 function issues the invalidation and proceeds without that wait. This
|
||||
is not a relocated instruction; it is an added completion check.
|
||||
|
||||
The DART violation names are not referenced by a direct `adr`/`adrp+add` — they
|
||||
are indexed through a violation table, so their exact raiser is a table lookup.
|
||||
The name itself is the evidence that 27.2 adds a check for the T8110 DART
|
||||
"ungang GAPF" race.
|
||||
|
||||
## MIE / MTE surface
|
||||
|
||||
MIE is not a single binary. The relevant pieces are:
|
||||
|
||||
- **SPTM**: manages tag pages and checks `MTE tag page containing SK tags is
|
||||
mapped`. The function is at `0xfffffff0270c6320` in 27.0.1 and
|
||||
`0xfffffff0270d7028` in 27.2; both are exactly 210 instructions, same prologue
|
||||
and same range-check shape (`subs` + `ccmp` against two globals). It was
|
||||
relocated, not rewritten.
|
||||
- **Kernel**: the MTE page allocator (`VM_KERN_MEMORY_MTAG`, taggable pages, MTE
|
||||
fill thread) has the same strings in both builds; no new MTE logic appears in
|
||||
the 62 new kernel strings.
|
||||
- **Exclave core**: carries the PMM tag machinery (`pmmtag_l4_decode`,
|
||||
`Conclave MTE tag check fault`, shared-memory tags), and grew by 229,376 B.
|
||||
That is a separate firmware update; no CVE in the advisory names it.
|
||||
|
||||
So the MIE *policy* surface in SPTM and XNU is unchanged in 27.2. The only
|
||||
MIE-adjacent code that changed is inside Exclave, which is a separate domain.
|
||||
|
||||
Related SPTM strings that were already present in 27.0.1 and remain:
|
||||
|
||||
- `%s: Dangling tag storage reference from previous mapping attempt`
|
||||
- `%s: Found SK-owned memory in non-wired memory`
|
||||
- `%s: dart %p (%s:%u): power down not permitted as SK still using the DART`
|
||||
|
||||
The dangling-tag check is a real state machine: a previous tag-storage mapping
|
||||
attempt can leave a reference that SPTM detects later. It exists in both builds,
|
||||
so it is not a 27.2 fix; it is an audit target.
|
||||
|
||||
### MTE check semantics (27.2, `0xfffffff0270d7028`)
|
||||
|
||||
The 210-instruction function is a PA-range gate, not a tag-value check:
|
||||
|
||||
```
|
||||
x19 = page PA
|
||||
if (x19 - [0xfffffff0270ae218] < ([0xfffffff0270ae220] - [0xfffffff0270ae218])) {
|
||||
... state bit test ...
|
||||
if (state bit) panic("%s: MTE tag page containing SK tags is mapped %#lx", x19)
|
||||
}
|
||||
```
|
||||
|
||||
The comparison is on the physical address. An alias that maps the same physical tag
|
||||
page at a different virtual address does not move the PA, so it does not avoid the
|
||||
check. A bypass would need to make SPTM see a different PA for the same tag memory
|
||||
(a page-table/IOMMU bug), or to corrupt the range globals / state bit — none of
|
||||
which is present in the 27.2 diff. This is why the MTE line remains a hypothesis,
|
||||
not a finding.
|
||||
|
||||
## Why Titan does not transfer
|
||||
|
||||
Titan (iOS 16.1–17.4b3, A14–A17) is not an SPTM logic bug. It uses:
|
||||
|
||||
1. AGX coprocessor code execution to overwrite the AGX `power` thread state;
|
||||
2. the AGX hibernation context to restore a attacker-supplied `TTBR1_EL1` and a
|
||||
second ROP stack (microPPL bypass);
|
||||
3. a self-referencing page-table entry to map and write any physical page,
|
||||
defeating PPL/SPTM.
|
||||
|
||||
Apple patched the AGX thread-state PAC in 18.1b4 and the TTBR restore in 17.4b4.
|
||||
The 27.2 SPTM diff is not a return of that bug: it is DART/hibernation hardening
|
||||
inside the monitor. A 27.2-era bypass would need a new primitive that can either
|
||||
(a) make SPTM map a page table it does not protect, or (b) corrupt the tag/SK
|
||||
metadata that SPTM trusts. There is no such primitive in the diff.
|
||||
|
||||
## Candidate bypass directions (hypotheses, not PoCs)
|
||||
|
||||
These are grounded in the 27.2 changes and the unchanged MIE checks. None is a
|
||||
working exploit; each needs a reachable primitive that the firmware diff does
|
||||
not supply.
|
||||
|
||||
0. **GMMU TLBI completion race (strongest static lead).** 27.0.1 lacks the
|
||||
completion wait that 27.2 adds to the DART invalidation path. A DMA-capable
|
||||
device whose translation is invalidated can keep using a stale GMMU entry if
|
||||
the invalidation has not completed; the stale entry is a DMA read/write to a
|
||||
page that SPTM has already unmapped or repurposed. This is an IOMMU bypass,
|
||||
not a page-table permission bypass, but it defeats the same isolation goal.
|
||||
Reachability requires a userclient that owns DART mappings and can keep DMA
|
||||
in flight across an unmap — the next thing to test on hardware.
|
||||
1. **DART unganged-GAPF race.** 27.2 adds a violation for a race between
|
||||
unganging a DART and a page-table remap. On 27.0.1 the race can leave a stale
|
||||
DART translation if a mapping is unganged while a PTE is remapped. A stale
|
||||
IOMMU translation is a DMA read/write primitive to memory SPTM considers
|
||||
protected. Reachability: a userclient that owns DART mappings (IOGPU, display,
|
||||
NVMe, PCIe). This is the closest analogue to a "SPTM bypass", but it is an
|
||||
IOMMU bypass, not a page-table permission bypass.
|
||||
2. **Hibernation handoff page count.** 27.2 adds
|
||||
`hib_header_copy->handoffPageCount < HIB_HANDOFF_PAGECOUNT_LIMIT` and the
|
||||
NVMe hibernation queue latch violation. On 27.0.1 a corrupted hibernation
|
||||
header could make SPTM restore from a handoff page it did not size-check.
|
||||
Reachability: modifying the hibernation image or the NVMe queue, not an app.
|
||||
3. **SK tag-page aliasing.** The SPTM check only rejects a tag page whose
|
||||
physical address falls in the `[start,end)` range loaded from two globals. A
|
||||
mapping that aliases the same physical tag page at a different PA, or a
|
||||
remap that changes the range after the check, would let user-controlled tags
|
||||
cover SK memory. That is an MIE bypass: forge the tag for an SK page, then
|
||||
read/write it. Reachability: a kernel primitive that maps tag storage with a
|
||||
user-influenced PA; not present in the 27.2 diff.
|
||||
4. **Dangling tag-storage reference.** SPTM already detects a dangling
|
||||
reference from a previous mapping attempt. A race between unmap and remap of
|
||||
tag storage could leave the stale reference usable; the freed tag page could
|
||||
be reallocated as a user tag page. Same MIE impact as (3).
|
||||
|
||||
## Verdict
|
||||
|
||||
- SPTM **did** change: 820.0.22 → 820.40.24, +64 KiB, DART/TLBI/hibernation
|
||||
hardening. The kernel-side `__DATA_SPTM` being identical is not evidence that
|
||||
SPTM is unchanged.
|
||||
- No SPTM/MIE bypass is named in the 27.2 advisory, and no page-table permission
|
||||
check was removed or weakened in the diff. The changes add checks.
|
||||
- MIE policy in SPTM/XNU is unchanged; Exclave changed separately.
|
||||
- A working bypass was **not** produced. The candidate paths above need a
|
||||
reachable primitive (DART userclient, tag-storage mapping, or hibernation
|
||||
image control) and a device session; writing one blind would be guesswork.
|
||||
|
||||
## Critical finding — the 27.2 TLBI verification is disabled on iPhone19,7
|
||||
|
||||
The check is conditional. SPTM's `uat_bootstrap_parse_dt` (27.2,
|
||||
`0xfffffff0270cbe18`) reads the `/arm-io/sgx` node and looks up
|
||||
`verify-gmmu-tlbis-at-sync`. The property-missing path is explicit:
|
||||
|
||||
```
|
||||
0xfffffff0270cc184 adrp x8, 0xfffffff0270ae000
|
||||
0xfffffff0270cc188 ldr x22, [x8, #0x208]
|
||||
0xfffffff0270cc18c strb wzr, [x22, #0x81] ; verify flag = 0
|
||||
0xfffffff0270cc190 ... continue parsing
|
||||
```
|
||||
|
||||
So if the property is absent, the verification is **off**, not fatal.
|
||||
|
||||
Now the device mapping:
|
||||
|
||||
- `BuildManifest.plist` maps **iPhone19,7 → DeviceClass `v64sap`**.
|
||||
- The 27.2 `DeviceTree.v64sap.im4p` (406,684 B decoded) contains
|
||||
`agx-address-space-mgmt-mode`, `tlbi-aperture-offset`, `dart-options` and the
|
||||
SAPT node, but **no** `verify-gmmu-tlbis-at-sync`,
|
||||
`gmmu-tlbi-verification-reg` or `gmmu-tlbi-verification-bit`.
|
||||
- The same strings are absent from the 27.2 iBoot, the AGX firmware, and the
|
||||
whole kernelcache. They exist only in SPTM itself.
|
||||
|
||||
The iPad images the reference report analysed (`j817ap` / `j820ap`) do carry the
|
||||
property, which is why beta3 looks fixed there. On iPhone19,7 the gate is
|
||||
missing, so the 27.2 build executes the **beta2 behaviour**: AMXOP25 loop →
|
||||
`dsb oshnxs` → clear pending count → continue, with the verification block
|
||||
skipped.
|
||||
|
||||
### What this means
|
||||
|
||||
- Reachability on the final 27.2 v6x-pandia build is confirmed: the
|
||||
`IOGPUFamily` kext still exports `IOGPUDeviceUserClient::s_new_resource`,
|
||||
`s_submit_command_buffers`, `s_create_io_command_queue`,
|
||||
`s_destroy_io_command_queue`, `s_perform_io`, `s_group_add_resources`,
|
||||
`s_group_remove_resources`, `s_create_vniodesc`; the kernel still contains
|
||||
`IOUAT doUnmap/queueUnmap/commitUnmaps/prepareFWUnmap`,
|
||||
`uat_get_root_table_paddr`, `pmap_iommu_ioctl_internal` and
|
||||
`sptm_check_sapt_is_writable`. So the user path from IOGPU to the SPTM UAT
|
||||
unmap exists unchanged.
|
||||
- Method handler addresses in the final v6x kext:
|
||||
`IOGPUDeviceUserClient::s_new_resource` = `0xfffffe000a176094`,
|
||||
`s_submit_command_buffers` = `0xfffffe000a176424`. Selector recovery is still
|
||||
blocked: there is no direct `bl` to either handler and no raw/chained pointer
|
||||
in the kext or the kernelcache; the dispatch is indirect and the table is
|
||||
relocated at boot. Recovering the selector numbers needs a decompiler
|
||||
(Ghidra/IDA/Hopper) or a live kernel view, neither of which is available here.
|
||||
- On iPhone19,7, the GMMU TLBI completion window is **not closed by 27.2**.
|
||||
The UAT unmap → data page freed → GMMU stale translation race remains.
|
||||
- The fix is a code change plus a per-device DeviceTree gate; the gate is absent
|
||||
on the iPhone 19,7 image. This is a fix-gating gap, not a new memory-safety bug.
|
||||
- This makes the Titan-style end goal (data page → PAPT page → GPU stale write →
|
||||
RO-zone writable alias) still applicable on an iPhone running 27.2, assuming
|
||||
the rest of the chain is reachable.
|
||||
|
||||
Caveat: this is static evidence (parser + DT + BuildManifest + component search).
|
||||
Runtime confirmation is a 27.2 iPhone boot with the DT dumped and the SPTM verify
|
||||
flag read; that device was not available here. The 18PM in this lab is 27.0.1,
|
||||
where the check does not exist at all.
|
||||
|
||||
### If the flag is present
|
||||
|
||||
If a future iPhone build adds the DT property, the check runs and the window
|
||||
closes (panic `Failed to verify TLBI` on a still-pending GMMU TLBI). That is the
|
||||
condition to test in the next firmware.
|
||||
|
||||
## Cutter / rz-ghidra decompilation
|
||||
|
||||
The open-source decompiler in Cutter 2.5.0 (`rizin` + `rz-ghidra`, no Java) was used
|
||||
to confirm the two key functions. Raw `__TEXT_EXEC,__text` is loaded as ARM64, and
|
||||
`retab` is patched to `ret` in a copy so the decompiler does not truncate.
|
||||
|
||||
MTE SK tag-page check (`0xfffffff0270d7028`, raw offset `0x23028`):
|
||||
|
||||
```c
|
||||
if ((uint64_t)arg1 < *(uint64_t *)0xffffffffffffa218 ||
|
||||
*(uint64_t *)0xffffffffffffa220 <= (uint64_t)arg1) {
|
||||
func_0x0004b2ac(arg1); // outside the SK tag-page PA range: normal path
|
||||
}
|
||||
// inside the range: panic "MTE tag page containing SK tags is mapped"
|
||||
```
|
||||
|
||||
TLBI completion path (`0xfffffff0270c7aac`, raw offset `0x13aac`): the decompiler
|
||||
shows the verification state being read (`uVar15 >> bit & 1`), a countdown
|
||||
(`uVar14`), and the GMMU invalidation issued through a code pointer inside the
|
||||
loop; 27.0.1 lacks this block (function 264 vs 369 instructions).
|
||||
|
||||
The IOGPU method handlers (`s_new_resource` at raw offset `0x70a4`,
|
||||
`s_submit_command_buffers` at `0x7434`) are PAC-heavy and the decompiler truncates
|
||||
at the first `pacibsppc`/`braa`; disassembly is still available, but selector
|
||||
recovery needs the dispatch table or a live kernel.
|
||||
|
||||
## Verification plan — GMMU TLBI completion race
|
||||
|
||||
The static delta is real, but exploitability depends on keeping a DART client's
|
||||
DMA in flight across an unmap. The test is hardware-only; it is written down here
|
||||
so the next session does not have to rediscover the shape.
|
||||
|
||||
Target: a disposable 27.0.1 device (vulnerable) and a 27.2 device (control).
|
||||
|
||||
Primitive needed: an IOGPU userclient plus IOSurface/metal command buffers. The
|
||||
kernel DART and IOGPU kexts are unchanged in 27.2 (IOGPU only gained a
|
||||
`systemPagingOff()` timeout diagnostic), so the user-reachable map/unmap path is
|
||||
the same on both builds; the fix lives inside SPTM.
|
||||
|
||||
Steps:
|
||||
|
||||
1. Allocate a page-aligned IOSurface `S`, fill it with a canary, map it through
|
||||
IOGPU, and record its physical pages if the API exposes them.
|
||||
2. Submit a long-running GPU write into `S` (a compute shader that keeps writing
|
||||
a pattern for several milliseconds).
|
||||
3. While the GPU work is in flight, unmap/free `S` through IOGPU so the DART
|
||||
entry is invalidated. On 27.0.1 the invalidation is not completion-checked.
|
||||
4. Immediately allocate a fresh page `P` (user or kernel object) and fill it with
|
||||
a different canary. If the GPU's writes land in `P`, the GMMU entry survived
|
||||
the unmap: a stale DMA write primitive.
|
||||
5. Escalate only after step 4 is observed: reuse `P` as a kernel object with a
|
||||
pointer field and use the GPU write to corrupt it.
|
||||
|
||||
Success criterion: a write to `P` after `S` was unmapped, reproducible on 27.0.1
|
||||
and absent on 27.2. A GPU timeout or a single crash is not success; the canary
|
||||
difference is.
|
||||
|
||||
Safety: run with the phone's panic log enabled, one stage at a time, and stop on
|
||||
the first unexpected kernel panic. The harness must journal the stage before the
|
||||
unmap (same pattern as Cinder27's GuardJournal).
|
||||
|
||||
## Verification plan — MIE tag storage
|
||||
|
||||
The SPTM `MTE tag page containing SK tags` check is unchanged, so a bypass here
|
||||
would be a new bug, not a 27.2 regression. It needs a kernel primitive that maps
|
||||
tag storage with a caller-influenced physical address (or a dangling tag-storage
|
||||
reference). The 27.2 diff does not expose such a primitive. The audit order is:
|
||||
|
||||
1. Find the kernel callers of the SPTM tag-storage map/unmap operations (the
|
||||
kernel MTE allocator, `VM_KERN_MEMORY_MTAG`).
|
||||
2. Check whether the PA is derived from a user-controlled IOSurface/descriptor.
|
||||
3. If yes, attempt an alias (map the same PA at a different address) and see
|
||||
whether the SPTM range check still rejects it.
|
||||
4. If the check is bypassed, forge the tag for an SK page and read/write it.
|
||||
|
||||
Until step 1 yields a user-influenced PA, this remains a hypothesis.
|
||||
|
||||
## Reproduce
|
||||
|
||||
```bash
|
||||
python3 tools/ipsw/remote_ipsw.py extract <url> sptm work/fw/27.2-sptm.im4p
|
||||
python3 tools/ipsw/ipswlib.py kernel ... # IM4P/LZFSE decode
|
||||
python3 tools/string_xref.py work/fw/27.2-sptm.bin "Failed to verify TLBI"
|
||||
python3 tools/fw_diff.py work/fw/27.0.1-sptm.bin work/fw/27.2-sptm.bin
|
||||
```
|
||||
@@ -0,0 +1,17 @@
|
||||
# ARM64 decompiler (Cutter / rizin / rz-ghidra)
|
||||
|
||||
IDA Pro is commercial; this uses the open-source decompiler bundled with Cutter 2.5.0
|
||||
(`/Applications/Cutter.app`). No Java is involved, so it works on macOS 27 where the
|
||||
Ghidra JVM crashes in CodeHeap.
|
||||
|
||||
```bash
|
||||
tools/decompiler/decompile.sh <raw-arm64-text.bin> <function-offset-hex>
|
||||
```
|
||||
|
||||
Raw blobs are the `__TEXT_EXEC,__text` section of a Mach-O (see
|
||||
`tools/ipsw/ipswlib.py` for extraction). `SLEIGHHOME` is set to the bundled
|
||||
`rz_ghidra_sleigh` specs; without it rz-ghidra reports "No sleigh specification".
|
||||
|
||||
Limitations: PAC instructions (`pacibsp`, `retab`) and some pointer-auth branches
|
||||
truncate the decompiler output. Patch `retab` (0xd65f0fff) to `ret` (0xd65f03c0) in
|
||||
a copy of the blob before decompiling; keep the original for ground truth.
|
||||
Executable
+8
@@ -0,0 +1,8 @@
|
||||
#!/bin/bash
|
||||
# Decompile one function from a raw ARM64 blob with Cutter's rz-ghidra.
|
||||
# usage: decompile.sh <raw.bin> <offset-hex> [sleighhome]
|
||||
set -e
|
||||
RZ=/Applications/Cutter.app/Contents/Resources/bin/rizin
|
||||
export DYLD_LIBRARY_PATH=/Applications/Cutter.app/Contents/Resources/lib
|
||||
export SLEIGHHOME=${3:-/Applications/Cutter.app/Contents/Resources/lib/rizin/plugins/rz_ghidra_sleigh}
|
||||
"$RZ" -a arm -b 64 -e scr.color=0 -q -c "s $2; af; pdg" "$1"
|
||||
@@ -0,0 +1,37 @@
|
||||
#!/usr/bin/env python3
|
||||
"""Check whether an IPSW's SPTM TLBI verification gate is enabled for a device.
|
||||
|
||||
Usage: python3 sptm_gate.py <sptm.bin> <devicetree.bin>
|
||||
Both inputs are decoded Mach-O/IM4P payloads (see remote_ipsw.py + ipswlib.py).
|
||||
|
||||
Background: SPTM 27.2 parses /arm-io/sgx and looks up
|
||||
verify-gmmu-tlbis-at-sync. If the property is missing it sets the verify flag
|
||||
to 0 (0xfffffff0270cc18c: strb wzr,[x22,#0x81]) and the GMMU TLBI completion
|
||||
check is skipped. This script reports whether the gate is present in the DT.
|
||||
"""
|
||||
import sys
|
||||
|
||||
KEYS = [
|
||||
b"verify-gmmu-tlbis-at-sync",
|
||||
b"gmmu-tlbi-verification-reg",
|
||||
b"gmmu-tlbi-verification-bit",
|
||||
]
|
||||
|
||||
|
||||
def main():
|
||||
sptm = open(sys.argv[1], "rb").read()
|
||||
dt = open(sys.argv[2], "rb").read()
|
||||
print("SPTM strings:")
|
||||
for k in KEYS:
|
||||
print(f" {k.decode():32} {'present' if k in sptm else 'absent'}")
|
||||
print("DeviceTree gate:")
|
||||
for k in KEYS:
|
||||
print(f" {k.decode():32} {'present' if k in dt else 'absent'}")
|
||||
gate = all(k in dt for k in KEYS)
|
||||
print()
|
||||
print("VERDICT:", "gate ENABLED" if gate else "gate DISABLED (SPTM check will be skipped)")
|
||||
return 0 if gate else 1
|
||||
|
||||
|
||||
if __name__ == "__main__":
|
||||
sys.exit(main())
|
||||
Reference in new issue
Block a user