Not a member of Pastebin yet?
Sign Up,
it unlocks many cool features!
- # cicuta_virosa
- iOS\iPadOS 14.3 kernel LPE for all devices by **@ModernPwner**. Please follow us on twitter :)
- # Current state
- - Exploit works :)
- - Need a lot of cleanup + more stable primitives that not relaying on memory reallocation. **Use it on your own risk**
- - Exploit will take more then 2 minutes because we can't understand how to properly bypass one stupid sanity check in kernel on "Stage 3: Convert uaf into pktopts uaf" (we'll fix it soon)
- - Reliability is amazing on our A13 and A10 devices
- # The vuln
- **CVE-2021-1782**: A race condition in user_data_get_value() leading to ivac entry uaf. This issue has been actively exploited in the wild with the WebKit exploit. We might release this RCE chain in the future.
- # Writeup
- Soon.
- # How to build it
- We don't like to commit Xcode project file. Create your own XCode project, add files and call "cicuta_virosa" function.
- # Credits
- - Some utils (exploit_utilities.c): @Jakeashacks
- - Vuln: Apple
- # License
- If you want to use it in your project under GPL not-compatible license - **please** DM us to get permissions.
- We give permissions to **@CStar_OW** to use and modify the exploit for Odyssey - the best jailbreak :).
- But we hope that all modifications will be open sourced.
- # PAC bypass
- For the moment we have a brand new technique to bypass PAC but we decided to not include such critical stuff here.
- **Maybe** we'll post a PAC bypass along with the iOS 14.5 exploit. This is in progress, we **may** publish 14.5 exploit after Apple patch.
Add Comment
Please, Sign In to add comment
