6 ms·
iOS 18.6.1 0-click RCE POC
- biosboiii 1y agoAlso crashes my MacOS Sequoia 15.3.1 Preview App :) https://gist.github.com/AltayAkkus/524acec2b16d4536af0fcee2f33cba16 https://gist.github.com/AltayAkkus/524acec2b16d4536af0fcee2f...
- kirito1337 1y agoDang that's so cool!
- deleted 1y ago[deleted]
- Alifatisk 1y agoI wonder how much this would be worth for Zerodium
- kingforaday 1y agoI know the thread is saying $0 because Zerodium doesn't exist anymore, but there are others. This [0] one for a full chain mobile iOS is at $15M. I agree with tptacek though, the airdrop would reduce the value but you may still be in the low 7 figure range for 0 click RCE. 0. https://advance-sec.com/#bounty https://advance-sec.com/#bounty
- tptacek 1y agoI don't think this is real. "Full chain Linux desktop" for $10MM? Uh huh. We recorded a podcast with Mark Dowd a year ago where he said nobody actually gets "list prices" for iOS full chain at $2.5MM (you can make considerably more than that by selling to multiple parties and by selling maintenance) --- and that's iOS, the highest-valued vulnerabilities.
- gruez 1y ago$0, given it's patched in ios 18.6.2
- crossroadsguy 1y agoBefore that obviously. Possibly pc meant to ask if the “finder” would have gone to them instead of dealing with Apple directly.
- tptacek 1y agoThe AirDrop requirement probably decreases its value substantially, but I think all these kinds of questions are kind of tricky to reason about: https://news.ycombinator.com/item?id=43025038 https://news.ycombinator.com/item?id=43025038 This might be a weird corner case where Apple would outbid the grey market, but generally even though Apple comes in lower than the grey market (for these very specific kinds of vulnerabilities), the term sheets are different, and the rest of the terms tend to favor going with Apple.
- rafram 1y agoAnd given that Zerodium has shut down.
- anon6362 1y agoIts website still works and there's a gpg key, so it's a "shutdown" rather than shutdown.
- tptacek 1y ago$0, since I don't think Zerodium still exists.
- MajesticHobo2 1y agoI AirDropped the PoC to my vulnerable iPhone. It didn't cause a crash until I tried to edit it in the Photos app.
- VladVladikoff 1y agoMaybe you need to iMessage it to someone else? Just guessing.
- byearthithatius 1y agoI downloaded the image he provided (https://www.dpreview.com/sample-galleries/4949897610/pentax-k-3-mark-iii-sample-gallery/1638788346 https://www.dpreview.com/sample-galleries/4949897610/pentax-...) The DNG file did have the 01 byte at `2FD00` (from xxd or hexdump -C). However it didn't have a byte position `3E40B`. I tried searching and there is literally no entry at that position. I found a 02 value at 3e40 but not at 3e40b. Is this a typo? Where did you find it to try and repro?
- MajesticHobo2 1y agoYou need to click the link that says "RAW (33.0MB)". The filename should be "IMGP0847.DNG".
- byearthithatius 1y agoThanks immensely. Very important detail, Did you find a 02 at 3E40B? I found 01 at 2FD00, but there was no 3E40B byte position entry. I did find something similar at 00003e40: 00003e40 02 00 04 00 0a 00 00 00 30 01 00 00 00 00 00 00 |........0.......|
- MajesticHobo2 1y agoYes: dd status=none if=IMGP0847.DNG bs=1 skip=0x3e40b count=1 | xxd 00000000: 02
- 1y ago
- gruez 1y agoNote that even though the CVE is for a RCE (remote code execution)[1], this specific PoC is at most a DoS (denial of service). There's more work needed to bypass mitigations for it to be actually usable as a RCE. [1] https://support.apple.com/en-us/124925 https://support.apple.com/en-us/124925
- bri3d 1y agoWhere's the 0-click or the RCE here? I'm actually really curious about how the ITW exploit for this CVE worked; the OOB write is quite obvious in hindsight but going from OOB write to execution on iOS is very much not easy these days, and going from OOB write to sandbox escape should be extremely hard, especially since I thought (?) all image previews in iMessage should be behind BlastDoor. There's a lot of interesting stuff that's still missing here.
- gruez 1y ago>Where's the 0-click or the RCE here? See my other comment. There's an exploit in the wild that uses this bug to get RCE, but this specific example just causes a crash.
- bri3d 1y agoYes, that's what I'm referring to with > I'm actually really curious about how the ITW exploit for this CVE worked It's really weird to see only a single OOB write patched for a full 0-click chain in the wild - how did they get code execution? PAC+ASLR bypass? Sandbox escape/kernel escalation? Literally only RawCamera is patched in the update - were the other bugs in the chain already patched? Too difficult to patch immediately? (ie - close the front door while working on replacing the other locks?)? Still unknown? (ie - found a crash dump from RawCamera but didn't get as sample of the full chain?)
- rvz 1y agoDoes this affect any of the iOS, iPadOS macOS, tvOS, watchOS 26 Beta?
- Reason077 1y agoApple patched it on August 20, so presumably any release from after this date is not vulnerable.
- mkhalil 1y agoSeems like it was major enough that it was the lone patch[0] in all active Apple OS's: macOS Ventura 13.7.8 | macOS Sonoma 14.7.8 | macOS Sequoia 15.6.1 iPadOS 17.7.10 | iPadOS 18.6.2 | iOS 18.6.2 Usually, its multiple CVE's in a security update. Examples: - https://support.apple.com/en-us/122375 https://support.apple.com/en-us/122375 (macOS Ventura 13.7.5) - https://support.apple.com/en-us/122718 https://support.apple.com/en-us/122718 (macOS Ventura 13.7.6) - https://support.apple.com/en-us/124151 https://support.apple.com/en-us/124151 (macOS Ventura 13.7.7) --------------------------- References/Sources --------------------------- [0] https://support.apple.com/en-us/124925 https://support.apple.com/en-us/124925 -> https://support.apple.com/en-us/124929 https://support.apple.com/en-us/124929 | (124925 -> 124929) https://support.apple.com/en-us/100100 https://support.apple.com/en-us/100100 https://nvd.nist.gov/vuln/detail/CVE-2025-43300#vulnConfigurationsArea https://nvd.nist.gov/vuln/detail/CVE-2025-43300#vulnConfigur...
- 0x0 1y agoSurprised to see no patch available for watchOS, which can also receive images via iMessage. Not important enough to patch, or not vulnerable, or just not exploited in the wild yet?
- transpute 1y agoFor iOS defense, enable Lockdown Mode and reboot daily to evict non-persistent malware, https://www.youtube.com/watch?v=fAhTPMmvrB0 https://www.youtube.com/watch?v=fAhTPMmvrB0 > For me, there is only lockdown mode. That is the Apple Experience. iOS backups can be scanned for the presence of this CVE-2025-43300 DNG processing vulnerability, via OSS tool for iOS forensics, https://github.com/msuiche/elegant-bouncer https://github.com/msuiche/elegant-bouncer | https://www.msuiche.com/posts/elegantbouncer-when-you-cant-get-the-samples-but-still-need-to-catch-the-threat/ https://www.msuiche.com/posts/elegantbouncer-when-you-cant-g... ELEGANTBOUNCER is a detection tool for file-based mobile exploits. It employs an innovative approach for advanced file-based threat identification, eliminating the need for in-the-wild samples and outperforming traditional methods based on regular expressions or IOCs. At present, it primarily targets the identification of mobile vulnerabilities such as FORCEDENTRY (CVE-2021-30860), BLASTPASS (CVE-2023-4863, CVE-2023-41064), and TRIANGULATION (CVE-2023-41990) [and recently added CVE-2025-43300]. https://x.com/darknavyorg/status/1959271176062251333 https://x.com/darknavyorg/status/1959271176062251333 > While reproducing the iOS ITW CVE-2025-43300 (support.apple.com/en-us/124925), we accidentally triggered another old DNG image parsing vulnerability. The analysis is still ongoing.
- ThePowerOfFuet 1y ago>For iOS defense, enable Lockdown Mode and reboot daily to evict non-persistent malware For non-iOS defense, run GrapheneOS with all the default safeguards enabled.
- notepad0x90 1y agoI would think mvt and related ioc repos would support these newer indicators,but sadly I'm not seeing that: https://docs.mvt.re/en/latest/iocs/ https://docs.mvt.re/en/latest/iocs/
- transpute 1y agoIt's a different approach: Traditional detection approaches like YARA rules, IOC matching, and signature-based systems fall apart when: • You don’t have the actual malicious samples to create signatures from • The attackers use polymorphic techniques that change file hashes • The exploit leverages legitimate file format features in unexpected ways • You need to detect future variants of the same technique The Philosophy: Structure Over Signatures ELEGANTBOUNCER takes a fundamentally different approach to threat detection. Instead of looking for specific byte patterns or known-bad indicators, it analyzes the structural properties of files that make exploits possible.
- zb3 1y agoOh, so we'll get another jailbreak soon? Wow, thanks [whatever Israeli agency/company is behind this] :)
- makestuff 1y agoHow do people even find these types of bugs? Is it just years and years experience allowing you to know where to look?
- tomasphan 1y agoExperience /n Fuzzing (when you try a bunch of stuff automatically) /n Reverse engineering the code (using tools like ghidra or hopper)
- NoPicklez 1y agoLots of experience in what are common exploit tactics are and where to look and test if things will break. Identifying an exploit in iOS requires a significant amount of knowledge in how the OS works, what existing exploits are and how you could chain them together to create a larger exploit. I've have very limited experience, but reading about how some people identify and exploit these things is extremely impressive.
- transpute 1y agoFuzzing is one approach. "Fuzzing ImageIO" (2020), https://googleprojectzero.blogspot.com/2020/04/fuzzing-imageio.html https://googleprojectzero.blogspot.com/2020/04/fuzzing-image... > This blog post discusses an old type of issue, vulnerabilities in image format parsers, in a new(er) context: on interactionless code paths in popular messenger apps. This research was focused on the Apple ecosystem and the image parsing API provided by it: the ImageIO framework. Multiple vulnerabilities in image parsing code were found, reported to Apple or the respective open source image library maintainers, and subsequently fixed. During this research, a lightweight and low-overhead guided fuzzing approach for closed source binaries was implemented and is released alongside this blogpost. "ImageIO, the infamous iOS Zero Click Attack Vector" (2024), https://r00tkitsmm.github.io/fuzzing/2024/03/29/iOSImageIO.html https://r00tkitsmm.github.io/fuzzing/2024/03/29/iOSImageIO.h... > I used LLDB to examine the testHeader functions, it turned out there are three new testHeader functions for different file formats, such as KTX2 and WebP and ETC, so because they were fairly new I thought maybe they have not been fuzzed by Project Zero... I ported Project Zero’s harness to Jackalope fuzzer.. My fuzzing effort found several vulnerabilities [fixed by Apple]..
- fmajid 1y agoIt's 2025, and Apple clearly still hasn't incorporated fuzzers in their CI and QA. Perhaps I am giving them too much credit in assuming they have any QA in the first place.
- transpute 1y agoImageIO has been fuzzed by Google and others, https://news.ycombinator.com/item?id=45034650 https://news.ycombinator.com/item?id=45034650
- tptacek 1y agoI have no idea what you're talking about; Apple has one of the largest and most sophisticated software security practices on the planet.
- pjmlp 1y agoThey do, but unfortunately it is built on top of a shacky foundation.
- user214412412 1y agois it me or does ios have a myriad of cves in in the image processing/decoder stack? You'd think they'd sandbox in some kind of memory safe framework/lang by now?
- muricula 1y agoLook up iMessage's "blastdoor" sandbox: https://support.apple.com/guide/security/blastdoor-for-messages-and-ids-secd3c881cee/web https://support.apple.com/guide/security/blastdoor-for-messa...
- kaladin-jasnah 1y agoFORCEDENTRY bypassed this sandbox IIRC. That was a bug in the JBIG2 decoder.
- jimmyl02 1y agounfortunately sandboxes also have bugs which allows for RCE. this is typically called a "full chain" because it chains together a series of bugs (initial decoder exploit + sandbox escape exploit) to gain full RCE
- ladyanita22 1y agoFor some reason, Apple seems reluctant about using Rust on their operating systems.
- steve1977 1y agoThat reason is probably called Swift. But they obviously still have many many system libraries written in Objective-C, plain C or C++. I don't see them using Rust when they have their own language under their full control, especially since both are targeting LLVM anyway.
- GoblinSlayer 1y agoAlso image formats are fairly stable, so they are a good candidate for a verified F* parser. Not sure how easy it is for pdf, maybe start with a reasonable subset of it.
- deleted 1y ago[deleted]
- khana 1y ago[dead]
- aspenmayer 1y agohttps://web.archive.org/web/20250827063813/https%3A%2F%2Fs3.amazonaws.com%2Ffiles.prod.dpreview.com%2Fsample_galleries%2F4949897610%2F5977691702.dng https://web.archive.org/web/20250827063813/https%3A%2F%2Fs3....