Deja-XNU

Posted by Ian Beer, Google Project Zero This blog post revisits an old bug found by Pangu Team and combines it with a new, albeit very similar issue I recently found to try to build a "perfect" exploit for iOS 7.1.2. State of the art An idea I've wanted to play with for a while is to revisit old...

CVE-2014-4418

Summary of CVE-2014-4418 findings: The issue concerns the IODataQueue implementation in IOKit where kernel trusted fields (queueSize, head, tail) live in a shared memory region mapped into userspace. IOSharedDataQueue extends IODataQueue and places an appendix immediately after the queue, enablin...

CVE-2014-4388

IOKit in Apple iOS before 8 and Apple TV before 7 does not properly validate IODataQueue object metadata, which allows attackers to execute arbitrary code in a privileged context via an application that provides crafted values in unspecified metadata fields, a different vulnerability than...