That is the same bug as already publicly documented from the patch by @elvanderb and exploited by @jaakerblom, see John's repo here:https://github.com/potmdehex/multipath_kfree …
Show this thread
iOS 11.4 patched kernel memory corruption bugs I reported in two distinct areas: mptcp and vfs. My exploit for the mptcp bug is here: https://bugs.chromium.org/p/project-zero/issues/detail?id=1558 … Please read the README. It requires an Apple developer cert.
-
-
-
The vfs bug doesn't require an Apple developer cert but is considerably harder to exploit. You get to write 8 NULL bytes off the end of a kalloc.16 buffer. It's sufficiently hard to exploit that it's worth trying just to demonstrate that such issues are reliably exploitable...
Show this thread -
see eg The Poisoned Nul Byte, 2014 by
@scarybeasts https://googleprojectzero.blogspot.com/2014/08/the-poisoned-nul-byte-2014-edition.html … . But it takes time. The mptcp exploit is mostly recycled bits of earlier exploits. The getvolattrlist bug needs some new techniques.Show this thread -
The trigger is here: https://bugs.chromium.org/p/project-zero/issues/detail?id=1564 … If you're in to iOS exploit dev take a go at it and blog about it! I'll publish what I have soon, hopefully this week.
Show this thread -
Finally: always keep your personal iOS devices up to date and only use these tools on devices which don't have any personal information and are only used for research.
Show this thread -
(footnote: for the vfs bug technically you can control a handful of bits in the 8 overflow bytes, the overflow value is actually two 4 byte flag fields. This may or may not help.)
Show this thread
End of conversation
New conversation -
-
-
So when is the jailbreak going to be released?
-
CoolStar has to use this exploit to update Electra to 11.3.1 for a jailbreak so either in a few hours or some time tomorrow
-
That’s best case scenario, let’s hope!
-
A month later...
End of conversation
New conversation -
-
-
THANK YOU LORD AND SAVIOR
Thanks. Twitter will use this to make your timeline better. UndoUndo
-
-
-
Is this the exploit we where waiting for ?
-
Though the one that doesn’t require $99 will be released this week
-
They saying he released both
End of conversation
New conversation -
-
-
I AM PISSING MYSELF
Thanks. Twitter will use this to make your timeline better. UndoUndo
-
-
-
ya está liberado!
Thanks. Twitter will use this to make your timeline better. UndoUndo
-
-
-
Thanks. Twitter will use this to make your timeline better. UndoUndo
-
Loading seems to be taking a while.
Twitter may be over capacity or experiencing a momentary hiccup. Try again or visit Twitter Status for more information.