2 ms·
Qualcomm, not Broadcom, and the linked article series doesn't discuss the IOMMU at all - it's not related to this exploit as far as anybody knows. Maybe you're
by bri3d 2y ago
Qualcomm, not Broadcom, and the linked article series doesn't discuss the IOMMU at all - it's not related to this exploit as far as anybody knows.
Maybe you're thinking of the "Operation Triangulation" exploit chain, which used write access to a bizarre mapped area that seems to relate to cache debugging, in order to patch the page table.
- conradev 2y agoNo, it should be there. From the link: > Lastly, in the final blog post we’ll explore the iPhone’s host isolation mechanisms, research the ways in which the Wi-Fi chip interacts with the host, and develop a fully-fledged exploit allowing attackers to gain complete control over the iOS kernel over-the-air, requiring no user interaction. Which is referring to this link: https://googleprojectzero.blogspot.com/2017/10/over-air-vol-2-pt-3-exploiting-wi-fi.html?m=1 https://googleprojectzero.blogspot.com/2017/10/over-air-vol-... That link is the one I am summarizing: > Sufficient isolation for DMA-capable components can be achieved by partitioning the visible memory space available to the peripheral using a dedicated hardware component - an I/O Memory Management Unit (IOMMU). Apple uses Qualcomm chips for cellular modems, and they use Broadcom for Wi-Fi. edit: I might have linked the original post incorrectly, there are many volumes and parts