Usbliter8: an A12/A13 SecureROM Exploit
1–10 of 39 posts
Re: Usbliter8: an A12/A13 SecureROM Exploit
#2Ohhhh this is interesting!!!!! I really miss the glory days of jailbreaking, it just unlocked so many handy, fun, and cool stuff. From running webservers to speeding up the terribly slow animations.
Re: Usbliter8: an A12/A13 SecureROM Exploit
#3supposedly an unfixable vulnerability possibly affecting several iPhone models. should be more relevant than 4 points imho.
Re: Usbliter8: an A12/A13 SecureROM Exploit
#4> The DesignWare USB controller stores up to three consecutive Setup packets in memory.
> Upon receiving a fourth Setup transaction, the DMA base address gets reset to its starting position before writing, akin to a ring buffer mechanism.
> After writing each received packet, the controller increments DOEPDMA by the size of data written. The reset operation is implemented by decrementing DOEPDMA by 24.
> The core issue arises because the controller also accepts smaller packets (though always stores in 4-byte chunks).
> Since the pointer increment does not match the fixed decrement amount, we end up with a buffer underflow primitive in 12-byte steps.
so the problem is directly in the hardware, not in driver
what kind of defense would work against such bugs?
====
wait, am I understanding it right that DMA access was given directly to the stack??
Re: Usbliter8: an A12/A13 SecureROM Exploit
#5supposedly an unfixable vulnerability possibly affecting several iPhone models. should be more relevant than 4 points imho.
Feel free to repost or email hn@ycombinator.com to have it put in pool.
Re: Usbliter8: an A12/A13 SecureROM Exploit
#6Re: Usbliter8: an A12/A13 SecureROM Exploit
#7[dead]
Re: Usbliter8: an A12/A13 SecureROM Exploit
#8Since this can only underflow and some written bits are not attacker-chosen, does this not imply that the patchable part of the software could reliably detect this just in time and panic on suspected USB DMA corruption? Where is the catch?
Re: Usbliter8: an A12/A13 SecureROM Exploit
#9Since this can only underflow and some written bits are not attacker-chosen, does this not imply that the patchable part of the software could reliably detect this just in time and panic on suspected USB DMA corruption? Where is the catch?
The exploit grants arbitrary code execution, it can just fix up the telltale signs of the USB DMA corruption before jumping to an updatable part of the boot flow
Re: Usbliter8: an A12/A13 SecureROM Exploit
#10Since this can only underflow and some written bits are not attacker-chosen, does this not imply that the patchable part of the software could reliably detect this just in time and panic on suspected USB DMA corruption? Where is the catch?
The exploit grants arbitrary code execution, it can just fix up the telltale signs of the USB DMA corruption before jumping to an updatable part of the boot flow
Ah, the exploit is all done before that!