4 ms·
Where's the 0-click or the RCE here? I'm actually really curious about how the ITW exploit for this CVE worked; the OOB write is quite obvious in hindsight but
by bri3d 1y ago
Where's the 0-click or the RCE here?
I'm actually really curious about how the ITW exploit for this CVE worked; the OOB write is quite obvious in hindsight but going from OOB write to execution on iOS is very much not easy these days, and going from OOB write to sandbox escape should be extremely hard, especially since I thought (?) all image previews in iMessage should be behind BlastDoor. There's a lot of interesting stuff that's still missing here.
- gruez 1y ago>Where's the 0-click or the RCE here? See my other comment. There's an exploit in the wild that uses this bug to get RCE, but this specific example just causes a crash.
- bri3d 1y agoYes, that's what I'm referring to with > I'm actually really curious about how the ITW exploit for this CVE worked It's really weird to see only a single OOB write patched for a full 0-click chain in the wild - how did they get code execution? PAC+ASLR bypass? Sandbox escape/kernel escalation? Literally only RawCamera is patched in the update - were the other bugs in the chain already patched? Too difficult to patch immediately? (ie - close the front door while working on replacing the other locks?)? Still unknown? (ie - found a crash dump from RawCamera but didn't get as sample of the full chain?)