Rendered at 03:10:32 GMT+0000 (Coordinated Universal Time) with Cloudflare Workers.
nfriedly 3 days ago [-]
This is awesome news! It isn't a jailbreak in and of itself, but it is the first step.
Right now we only have a reliable jailbreak (checkm8) for up to iOS 18 (and that's only thanks to one iPad model). Some app developers are pretty aggressive about dropping support for older iOS versions.
This affects iPhone XR, XS, 11, SE 2nd gen, and a smattering of iPads. Many of these devices got the iOS 27 beta and will likely see future iOS versions for at least another year or two.
That's what I thought as well. I read the headline and was surprised that SecuROM was still around and was confused what it had to do with Apple... until I saw your comment.
Scoundreller 48 minutes ago [-]
Time for my annual check, and yep, gamecopyworld.com is still kickin' with roughly the same theme since 1998
Velocifyer 2 hours ago [-]
A DRM scheme that often failed to work and had a limit to the amount of installs.
djfergus 12 hours ago [-]
Sounds like it’s a low level hardware/firmware hole that can’t be patched.
thenthenthen 5 days ago [-]
Ohhhh this is interesting!!!!! I really miss the glory days of jailbreaking, it just unlocked so many handy, fun, and cool stuff. From running webservers to speeding up the terribly slow animations.
wowczarek 3 hours ago [-]
...or adding system-wide Copy and Paste when the iPhone first launched without it...
Lammy 1 hours ago [-]
Imagine four balls on the edge of a cliff.
Say a direct copy of the ball nearest the cliff is sent to the back of the line of balls and takes the place of the first ball. The formerly first ball becomes the second, the second becomes the third, and the fourth falls off the cliff.
DOEPDMA works the same way.
edelbitter 4 days ago [-]
Since this can only underflow and some written bits are not attacker-chosen, does this not imply that the patchable part of the software could reliably detect this just in time and panic on suspected USB DMA corruption? Where is the catch?
auguzanellato 4 days ago [-]
The exploit grants arbitrary code execution, it can just fix up the telltale signs of the USB DMA corruption before jumping to an updatable part of the boot flow
edelbitter 4 days ago [-]
Ah, the exploit is all done before that!
raffael_de 5 days ago [-]
supposedly an unfixable vulnerability possibly affecting several iPhone models. should be more relevant than 4 points imho.
Cider9986 5 days ago [-]
Feel free to repost or email hn@ycombinator.com to have it put in pool.
xphos 5 days ago [-]
Yeah this is definitely a front pager big news in the Jailbreaking world
NooneAtAll3 5 days ago [-]
> The DesignWare USB controller stores up to three consecutive Setup packets in memory.
> Upon receiving a fourth Setup transaction, the DMA base address gets reset to its starting position before writing, akin to a ring buffer mechanism.
> After writing each received packet, the controller increments DOEPDMA by the size of data written. The reset operation is implemented by decrementing DOEPDMA by 24.
> The core issue arises because the controller also accepts smaller packets (though always stores in 4-byte chunks).
> Since the pointer increment does not match the fixed decrement amount, we end up with a buffer underflow primitive in 12-byte steps.
so the problem is directly in the hardware, not in driver
what kind of defense would work against such bugs?
====
wait, am I understanding it right that DMA access was given directly to the stack??
Graziano_M 32 minutes ago [-]
The DMA buffer points to the heap.
The USB controller has access to it, but it only increments it and decrements.
By sending multiple packets that are smaller than typical, we can trick the USB controller to decrement the base pointer by more than it should, getting to underflow.
It so happens that on A12, the DMA buffer is after the USB task stack, so getting it to decrement by enough will get it to point to the task stack, where we can then write to LR and control where some function on the stack will eventually return to.
summa_tech 3 hours ago [-]
On most modern Apple SoCs, including these two, there's an IOMMU dedicated to the USB complex (called the USB DART, perhaps DMA Address Remapping Table).
However, Boot ROM on these two chips does not program it; Apple probably felt that it was an unnecessary technical risk to do so. The Boot ROM code was well-verified and unlikely to contain bugs like buffer overflows. But nobody expected a hardware bug :)
Right now we only have a reliable jailbreak (checkm8) for up to iOS 18 (and that's only thanks to one iPad model). Some app developers are pretty aggressive about dropping support for older iOS versions.
This affects iPhone XR, XS, 11, SE 2nd gen, and a smattering of iPads. Many of these devices got the iOS 27 beta and will likely see future iOS versions for at least another year or two.
Edit: here's the affected iPads:
* iPad Pro 11" (gen 1-2)
* iPad Pro 12.9" (gen 3-4)
* iPad mini (gen 5)
* iPad Air (gen 3)
* iPad (gen 8-9)
Say a direct copy of the ball nearest the cliff is sent to the back of the line of balls and takes the place of the first ball. The formerly first ball becomes the second, the second becomes the third, and the fourth falls off the cliff.
DOEPDMA works the same way.
> Upon receiving a fourth Setup transaction, the DMA base address gets reset to its starting position before writing, akin to a ring buffer mechanism.
> After writing each received packet, the controller increments DOEPDMA by the size of data written. The reset operation is implemented by decrementing DOEPDMA by 24.
> The core issue arises because the controller also accepts smaller packets (though always stores in 4-byte chunks).
> Since the pointer increment does not match the fixed decrement amount, we end up with a buffer underflow primitive in 12-byte steps.
so the problem is directly in the hardware, not in driver
what kind of defense would work against such bugs?
====
wait, am I understanding it right that DMA access was given directly to the stack??
The USB controller has access to it, but it only increments it and decrements.
By sending multiple packets that are smaller than typical, we can trick the USB controller to decrement the base pointer by more than it should, getting to underflow.
It so happens that on A12, the DMA buffer is after the USB task stack, so getting it to decrement by enough will get it to point to the task stack, where we can then write to LR and control where some function on the stack will eventually return to.
However, Boot ROM on these two chips does not program it; Apple probably felt that it was an unnecessary technical risk to do so. The Boot ROM code was well-verified and unlikely to contain bugs like buffer overflows. But nobody expected a hardware bug :)