6 Photos and videos
I've audited the Android kernel in late 2023, and reported 10 kernel bugs to Google, along with 2 exploits. Today, I'm releasing the first exploit, targeting the Mali GPU on Pixel devices, accessible from an untrusted_app context.
github.com/0x36/Pixel_GPU_Ex…
27
262
1,044
114,889
I'm sharing two other iOS kernel vulnerabilities reachable from the default app sandbox that don’t require you to open a UserClient:
0x36.github.io/CVE-2022-3289…
15
116
465
CVE-2022-32932 is another vulnerability I discovered in the ANE kernel interface; this is a double fetch issue that resulted in an interesting OOB write.
0x36.github.io/CVE-2022-3293…
9
71
269
My #POC2022 slides the iOS kernel r/w exploit can be found here :)
github.com/0x36/weightBufs/
Thanks @POC_Crew for a fantastic conference and truly honored to have been part of it.
22
198
598
16 kernel bugs I reported to Apple have been fixed in iOS 16/16.1. I'll give a talk on how I chained some bugs to achieve kernel r/w at #POC2022 next month, and the kernel exploit for iOS 15 will be released along with a some other high impact vulns after the conference.
30
142
757
In iOS 15.5 beta 3, Apple removed IOMallocAligned(KHEAP_DEFAULT,...) from IOSharedDataQueue/IODataQueue::initWithCapacity() ( now uses kernel_memory_allocate() with KMA_DATA flag). It was an elegant technique to groom the kernel default heap with user controlled data. RIP
7
37
275
I’ve updated ghidra_kernelcache! now it’s compatible with Ghidra 10.1 , macOS KEXT/Kernelcache support, PAC Xrefs, better class definition with custom class construction feature, dwarf4 and more ... check it out.
github.com/0x36/ghidra_kerne…
2
26
125
Looks like Ghidra does not support LC_DYLD_CHAINED_FIXUPS for macOS M1 KEXTs, here is a dirty script to fix it .
gist.github.com/0x36/5ea657f…
1
4
23
Here is a PoC kernel exploit, it demonstrates how to get kernel task port on iOS 13.7. I will update the PoC with a writeup later.
github.com/0x36/oob_events
27
115
459
PoC for iOS kernel bug reachable from within the sandbox, I may drop the exploit later
gist.github.com/0x36/ebb6af8…
18
159
520
ghidra_kernelcache: a Ghidra iOS kernelcache framework for reverse engineering
github.com/0x36/ghidra_kerne…
6
33
134