4 ms·

Is this possibly a route to jailbreaking for iOS, via the temporary provisioning profile for apps? It seems like you could run a Rowhammer memory corruption app

Is this possibly a route to jailbreaking for iOS, via the temporary provisioning profile for apps? It seems like you could run a Rowhammer memory corruption app on your personal device until getting escalated privileges. Newer OS releases may not patch the hole since this is a hardware flaw. But I admittedly have only the vaguest idea of what defenses need overcoming on a modern iOS device.

londons_explore 5y ago
Rowhammer is still pretty hard to exploit because typically you can't reliably flip most bits, and you can normally only flip bits that are very close in physical memory address to those you control. Combine that with a lack of knowledge of physical memory addresses and inability to have much control over memory layouts, and it really gets tricky to gain privileges outside a lab environment in a reasonable short time. Remember that flipping bits at random will almost certainly kernel panic the machine before it gives you root access. I'm sure a determined attacker could do it though.
- jandrese 5y ago
  This seems like a case where targeting an iPhone might make life easier. The hardware is quite uniform for a particular model.
  - SV_BubbleTime 5y ago
    Which gets you some architecture knowledge, but doesn’t promise or indicate that your userland ram space is adjacent to anything important. It’s a better start at playing the game though.
- guerrilla 5y ago
  > very close in physical memory address to those you control. Not quite. It doesn't require the ability to write to the neighboring cells, just read from them.
- chasil 5y ago
  Hopefully, the OpenBSD extreme implementation of ASLR makes it even safer. On every boot, there is a brand new kernel and C library: reordering libraries: done reorder_kernel: kernel relinking done ASLR has been compromised in the past, so this likely isn't completely secure.

londons_explore 5y ago

Rowhammer is still pretty hard to exploit because typically you can't reliably flip most bits, and you can normally only flip bits that are very close in physical memory address to those you control. Combine that with a lack of knowledge of physical memory addresses and inability to have much control over memory layouts, and it really gets tricky to gain privileges outside a lab environment in a reasonable short time. Remember that flipping bits at random will almost certainly kernel panic the machine before it gives you root access. I'm sure a determined attacker could do it though.

jandrese 5y ago
This seems like a case where targeting an iPhone might make life easier. The hardware is quite uniform for a particular model.
- SV_BubbleTime 5y ago
  Which gets you some architecture knowledge, but doesn’t promise or indicate that your userland ram space is adjacent to anything important. It’s a better start at playing the game though.
guerrilla 5y ago
> very close in physical memory address to those you control. Not quite. It doesn't require the ability to write to the neighboring cells, just read from them.
chasil 5y ago
Hopefully, the OpenBSD extreme implementation of ASLR makes it even safer. On every boot, there is a brand new kernel and C library: reordering libraries: done reorder_kernel: kernel relinking done ASLR has been compromised in the past, so this likely isn't completely secure.