8 ms·
Apple fixes zero-day bug in Apple Vision Pro that 'may have been exploited'
- judge2020 3y agoPossibly related - https://x.com/0xjprx/status/1753575170101461266?s=20 https://x.com/0xjprx/status/1753575170101461266?s=20 > The world's first(?) kernel exploit for Vision Pro- on launch day! image 1: https://pbs.twimg.com/media/GFXzO5kXMAA-y7k?format=jpg&name=4096x4096 https://pbs.twimg.com/media/GFXzO5kXMAA-y7k?format=jpg&name=... image 2: https://pbs.twimg.com/media/GFXzQOJWYAA41sV?format=jpg&name=large https://pbs.twimg.com/media/GFXzQOJWYAA41sV?format=jpg&name=...
- charcircuit 3y agoThat only shows a kernel panic. An exploit would prevent the kernel from crashing.
- swozey 3y agoHow can malware prevent a panic? Its process is priority over pid1? I'm very ignorant to this stuff. Wouldn't the kernel know it's being manipulated, like a startup/JIT checksum or something?
- mort96 3y agoA kernel panic is caused by some serious issue in either the kernel or the hardware. In itself, it's relatively "harmless": it just means the OS stops doing anything and you need to hard reboot the machine (such as by cutting power). However, if the kernel panic is caused by a software bug (rather than something like a broken RAM stick), then the bug which causes the kernel panic might also be exploitable by malicious code to do things like arbitrary kernel level code execution. For example, if the problem is that the kernel somehow allows the user to change a piece of memory which the kernel interprets as a function pointer, then the result of carelessly changing that piece of memory will cause the kernel to jump into some part of memory that's not valid code, causing a kernel panic; however, a very clever attacker may pick a jump address which causes the kernel to keep executing without crashing but doing something which the developer of the kernel didn't intend. Maybe the attacker can cause the kernel to jump to a location in memory which the attacker has control over, which would mean that the attacker can run arbitrary code in kernel mode. This stuff is all very complicated and very interesting, I recommend reading up on it if it interests you. And no, the kernel can't really check if it's being manipulated. A checksum at startup wouldn't do it since these sorts of exploits don't tend to involve changing the kernel bytes on disk, but rather tricking the kernel into doing something it's not supposed to. There are various mechanisms to try to make bugs unexploitable (such as address space layout randomisation), but fundamentally, you can't perfectly protect against potential bugs.
- swozey 3y agoThanks! Yeah I really need to work on my low level security knowledge this stuff is fascinating when it isn't presented in the form of a crypto algorithim that is heirogylphics to me.
- PeterisP 3y agoThe general idea is that an exploitable remote code execution bug is some specific circumstances where the processor starts to execute whatever is in some wrong address which can be manipulated by an attacker. If the bug is successfully exploited, the attacker arranges so that everything is just so that device runs "as if normal" but executes whatever code attacker decided to be executed; but if the bug is triggered accidentally or without a working exploit, then it attempts to execute something random and that results in a kernel panic. So the way how "malware prevents a kernel panic" is that it's a successful exploit if and only if it manages to ensure that valid (but attacker-controlled) code runs and actually works, and if it instead results in a kernel panic, well, that's not a working malware, unless all the attacker wanted was a denial of service exploit.
- bpye 3y agoI'm kind of impressed that a kernel panic doesn't just result in a black screen and that passthrough still works.
- teaearlgraycold 3y agoI’m not super informed here, but I believe the AR stuff, including eye tracking, takes place on a coprocessor. The OS on the M2 chip could die and you’d still have passthrough.
- hparadiz 3y agoValve Index is similiar. I've had my whole desktop freeze but the spatial orientation is still drawing within the VR as the headset is moving albiet in a frozen state.
- charcircuit 3y agoThe Valve Index does not do reprojection on the device. It does not even do tracking on the device.
- FirmwareBurner 3y agoIt does it on the PC?
- charcircuit 3y agoYes, the runtime handles interpreting the sensor data collected by the device to compute the position and orientation they are in space. The compositor will reproject the next frame it sends to the headset if the application producing the frames does not submit frames before the deadline.
- DOGMATICA 3y agoSteamVR’s tracking page[1] explains it a little. The HMD is really just displays, radios to talk the controllers (standalone trackers will just have a dongle, runs the same firmware iirc), and its own chip to talk to its own tracking sensors. All the tracking stuff amounts to timing information which is screamed over USB to the PC which does all the math to figure out where you are. A bulk of this (really interesting!) information can be found on their HDK documentation, but that requires you to sign up with Steamworks. [1]: https://partner.steamgames.com/vrlicensing https://partner.steamgames.com/vrlicensing
- qingcharles 3y agoRealityDevice running on xrOS.
- ibero 3y agoThe current theory in the community is that since visionOS is based on iPadOS that it's more of a reference to a possible known exploitation on iPad that requires similar attestation on visionOS.
- fouc 3y agoImagine walking or driving when your AR gets hijacked, you could be at risk of walking into traffic or crashing the vehicle.
- GenerocUsername 3y agoIf only there was a way to prevent this
- randallsquared 3y agoAvoiding any walking or driving? Sure, I guess, but most people can't stay at home forever any more than they could avoid using a phone.
- bpye 3y agoYou can still walk or drive - just take the headset off to do it…
- pinkmuffinere 3y agoHow are you supposed to know when the headset is going to fail though??? I guess in some failure modes you might anticipate it failing, but surely not all… (/s)
- Detrytus 3y agoBut walking with your headset on can be a part of the value proposition, by adding some metadata to what you see. Imagine being shown directions in an unfamiliar place. Or seeing a distant bus and being told that this is the bus you're trying to catch. Once the technology becomes popular people will find a lot of reasons to walk with their headsets on.
- dimask 3y agomaybe with less intrusive and lighter optical AR glasses that do not cover all your field of view, walking around the city would be more possible. But expecting to go around the streets or even drive with a huge AR headset is unreasonable for our times.
- deleted 3y ago[deleted]
- bsimpson 3y agoI'm surprised they shipped with the product name RealityDevice14,1.
- quenix 3y agoThe code name is always displayed in panic and crash logs. For example, a kernel panic on my MacBook would display MacBookAir10,1. Or do you mean you find the code name itself funny?
- alertuser 3y agoIt's not Reality, so yes.
- bsimpson 3y agoYes. MacBookAir is a product. RealityDevice is a code name that leaked into a userfacing place.
- iAMkenough 3y agoHomePods are: AudioAccessory1,1 – First gen HomePod AudioAccessory5,1 - HomePod mini AudioAccessory6,1 - Second gen HomePod
- kanwisher 3y agoN64 was called Project Reality ...
- LeoPanthera 3y ago(Jan 31) - before launch day.
- lsllc 3y agoMakes me think of Neal Stephenson's Snowcrash and when Da5id views the scroll with the meta virus and ends up "crashing" (that's the snow crash!). The analog here would be a if you looked at the "wrong" thing (image, or a "malicious" QR code!) with Vision Pro and it contained the 0-day and then you were hacked!
- c0balt 3y agoCover your sensors! They've got corruption armor /s
- booleandilemma 3y agoI'm more worried about neuralink zero-days.
- apapapa 3y agoWhy? It would only affect one person and a few monkeys Or do you mean that you are nuts enough to get one in your skull?
- gigel82 3y agoOh no, both active users should be very worried. /s
- deleted 3y ago[deleted]