6 ms·
About the security content of iOS 15.4.1 and iPadOS 15.4.1
- gzer0 5y agoMore info on the exploit that was patched found here: https://cwe.mitre.org/data/definitions/787.html https://cwe.mitre.org/data/definitions/787.html. An application may be able to execute arbitrary code with kernel privileges.
- EE84M3i 5y agoDid you mean to link to a CWE page? This isn't about a specific bug.
- yunohn 5y agoIsn’t it? The patch is specifically to address: > An out-of-bounds write issue was addressed with improved bounds checking. (CVE-2022-22675) Which sounds exactly like a CWE-787 candidate.
- Thorrez 5y agogzer0's comment is a bit confusing. It could either be interpreted as saying "here's more info about this exact vulnerability" or "here's more info about this category of vulnerabilities". EE84M3i interpreted the comment as the first, but then saw the link is actually the second, and thought maybe EE84M3i made a mistake with the comment.
- mhio 5y agoI read it as the second as well just due to the link, but > More info on the <type of> exploit that was patched found here might have inferred the category of vulnerabilities more.
- deleted 5y ago[deleted]
- WatchDog 5y agoWhat is AppleAVD? Audio video decode?
- tlokas 5y agoThis is a shot in the dark, but could it be Azure Virtual Desktop for iOS?
- bobabob 5y agoIt's a kernel extension for audio and video decoding. /System/Library/Extensions/AppleAVD.kext/
- SeanDMiddleton 5y agoThanks for answering the question bobabob.
- saagarjha 5y agoIt's a kext for decoding HEVC, H.264, and VP9.
- LeoNatan25 5y agoSounds to me like a terrible OS design, to have such arbitrary things as video decoding, require a kernel extension. Microsoft move drivers, such as GPU, to user space, to escape exactly issues like these. This is likely done for the sake of DRM, which is even worse. But SiDeLoADiNg is what is threatening users’ security.
- thetinguy 5y ago> Sounds to me like a terrible OS design, to have such arbitrary things as video decoding, require a kernel extension Why?
- deleted 5y ago[deleted]
- robin_reala 5y agoSame bug on macOS, along with an Intel graphics driver issue: https://support.apple.com/en-gb/HT213220 https://support.apple.com/en-gb/HT213220
- saagarjha 5y agoThis update also happens to include a bug fix for an actual instruction selection bug in the compiler that miscompiled the Swift runtime libraries for certain devices. So if the security benefits didn’t convince you, consider making some mobile release engineers happy :)
- wbond 5y agoCould provide a link with some info? I tried to look around to confirm but didn’t find anything. This sounds like it could be really useful.
- saagarjha 5y agoSomeone's reported this as https://bugs.swift.org/browse/SR-16047 https://bugs.swift.org/browse/SR-16047. The bug is that A11 and older processors don't have a CAS instruction, and LLVM's lowering accidentally added xzr to the set of "valid registers" for the replacement instruction sequence. So if you're seeing crashes in MetadataAllocator in iOS 15.4, this is probably going to fix it for you.
- saagarjha 5y agoAlso probably interesting: https://twitter.com/patch1t/status/1509767175946792966 https://twitter.com/patch1t/status/1509767175946792966
- shmatt 5y agoNSO is currently crumbling due to an internal all out war between the owners (in a war between themselves) and the debt owners (who have sided with 1 of the smaller shareholders) The majority shareholder is trying to kill off the Pegasus branch via keeping all of the leveraged debt they took on on their side, I have to wonder if this "anonymous researcher" has anything to do with that https://en.globes.co.il/en/article-squabbling-threatens-15b-sale-of-nso-group-1001407395 https://en.globes.co.il/en/article-squabbling-threatens-15b-... If this was one of Pegasus' main 0days post "FORCEDENTRY" patch, this would make this fight quiet down very quickly