3 ms·
The Secure Enclave is nowhere between the AP and the Broadcom chip. The application processor has an IOMMU and the kernel uses it to restrict what the Broadcom
by conradev 2y ago
The Secure Enclave is nowhere between the AP and the Broadcom chip.
The application processor has an IOMMU and the kernel uses it to restrict what the Broadcom chip has access to, and the linked article series discusses exploiting the IOMMU. There is more detail in the Project Zero write-up than Apple's own PDF.
The actual solution here is to remove the insecure Broadcom chip entirely, which is what Apple ultimately did. PCI-e and MMIO are quite risky, but ultimately necessary for performance. I think PinePhone series talks to their Broadcom chip over USB, which is a lot more secure, but the performance is worse.
- bri3d 2y agoQualcomm, not Broadcom, and the linked article series doesn't discuss the IOMMU at all - it's not related to this exploit as far as anybody knows. Maybe you're thinking of the "Operation Triangulation" exploit chain, which used write access to a bizarre mapped area that seems to relate to cache debugging, in order to patch the page table.
- conradev 2y agoNo, it should be there. From the link: > Lastly, in the final blog post we’ll explore the iPhone’s host isolation mechanisms, research the ways in which the Wi-Fi chip interacts with the host, and develop a fully-fledged exploit allowing attackers to gain complete control over the iOS kernel over-the-air, requiring no user interaction. Which is referring to this link: https://googleprojectzero.blogspot.com/2017/10/over-air-vol-2-pt-3-exploiting-wi-fi.html?m=1 https://googleprojectzero.blogspot.com/2017/10/over-air-vol-... That link is the one I am summarizing: > Sufficient isolation for DMA-capable components can be achieved by partitioning the visible memory space available to the peripheral using a dedicated hardware component - an I/O Memory Management Unit (IOMMU). Apple uses Qualcomm chips for cellular modems, and they use Broadcom for Wi-Fi. edit: I might have linked the original post incorrectly, there are many volumes and parts