{"uuid": "9de0f734-d5cf-4052-9ff5-fb30b3bd8ce9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-23222", "type": "seen", "source": "https://t.me/ProfessorDiscussions/30646", "content": "EXPLOIT CHAIN COMPONENT ANALYSIS\n\nARCHITECTURE OVERVIEW\n\u200f1. \u0645\u0643\u0648\u0646\u0627\u062a \u0627\u0644\u0633\u0644\u0633\u0644\u0629 \u0627\u0644\u0623\u0633\u0627\u0633\u064a\u0629:\n\u200f- index.html \u2014 \u0646\u0642\u0637\u0629 \u0627\u0644\u062f\u062e\u0648\u0644 \u0639\u0628\u0631 WebView \u0623\u0648 Safari renderer.\n\u200f- rce_loader.js \u2014 \u062a\u062d\u0645\u064a\u0644 \u0627\u0644\u0640 payload \u0627\u0644\u0623\u0648\u0644\u064a \u0648\u0625\u062f\u0627\u0631\u0629 \u0627\u0644\u0627\u062a\u0635\u0627\u0644.\n\u200f- rce_worker.js \u2014 \u062a\u0646\u0641\u064a\u0630 \u0627\u0644\u0640 shellcode \u0641\u064a \u0633\u064a\u0627\u0642 \u0627\u0644\u0640 renderer.\n\u200f- sbx_main.js \u2014 \u0627\u0644\u0647\u0631\u0648\u0628 \u0645\u0646 Sandbox \u0644\u0644\u0648\u0635\u0648\u0644 \u0625\u0644\u0649 \u0646\u0638\u0627\u0645 \u0627\u0644\u0645\u0644\u0641\u0627\u062a.\n\u200f- pe_main.js \u2014 \u0631\u0641\u0639 \u0627\u0644\u0635\u0644\u0627\u062d\u064a\u0627\u062a \u0625\u0644\u0649 kernel level.\n\n---\n\nSANDBOX ESCAPE \u2014 SBX_MAIN.JS\n\nCURRENT LIMITATIONS IN IOS 19+\n\u200f1. \u062a\u062d\u0633\u064a\u0646\u0627\u062a PAC (Pointer Authentication Code):\n\u200f- \u064a\u0633\u062a\u062e\u062f\u0645 ARMv8.3+ \u062a\u0648\u0627\u0642\u064a\u0639 \u0645\u0634\u0641\u0631\u0629 \u0644\u0644\u0640 function pointers \u0648return addresses.\n\u200f- \u0623\u064a \u062a\u0639\u062f\u064a\u0644 \u0639\u0644\u0649 \u0627\u0644\u0640 pointer \u064a\u064f\u0641\u0634\u0644 \u0627\u0644\u0640 signature verification.\n\u200f- \u0627\u0644\u0640 exploits \u0627\u0644\u062a\u0642\u0644\u064a\u062f\u064a\u0629 \u0627\u0644\u062a\u064a \u062a\u0633\u062a\u0628\u062f\u0644 function pointers \u0623\u0635\u0628\u062d\u062a \u063a\u064a\u0631 \u0641\u0639\u0627\u0644\u0629.\n\n2. Memory Tagging Extension (MTE):\n\u200f- \u064a\u064f\u062e\u0635\u0635 tags \u0644\u0643\u0644 \u0643\u062a\u0644\u0629 \u0630\u0627\u0643\u0631\u0629 (\u0627\u0644\u0640 allocation tag).\n\u200f- \u064a\u064f\u062e\u0632\u0646 tag \u0645\u0637\u0627\u0628\u0642 \u0641\u064a \u0627\u0644\u0640 pointer (\u0627\u0644\u0640 address tag).\n\u200f- \u0627\u0644\u0648\u0635\u0648\u0644 \u0644\u0623\u064a \u0645\u0646\u0637\u0642\u0629 \u0630\u0627\u0643\u0631\u0629 \u0628\u0640 tag \u063a\u064a\u0631 \u0645\u062a\u0637\u0627\u0628\u0642 = crash \u0641\u0648\u0631\u064a.\n\u200f- \u064a\u0643\u0634\u0641 Use-After-Free \u0648Buffer Overflow \u0628\u0646\u0633\u0628\u0629 \u0627\u0643\u062a\u0634\u0627\u0641 \u062a\u0642\u0627\u0631\u0628 100%.\n\nEVOLUTION STRATEGY FOR SBX_MAIN.JS\n\u200f1. \u0627\u0633\u062a\u0647\u062f\u0627\u0641 Logic Bugs \u0628\u062f\u0644\u0627\u064b \u0645\u0646 Memory Corruption:\n\u200f- \u0627\u0644\u0628\u062d\u062b \u0639\u0646 \u062b\u063a\u0631\u0627\u062a \u0641\u064a \u0627\u0644\u0640 IPC handlers \u0628\u064a\u0646 \u0627\u0644\u0640 processes \u0627\u0644\u0645\u0633\u0645\u0648\u062d \u0644\u0647\u0627 \u0628\u0627\u0644\u062e\u0631\u0648\u062c \u0645\u0646 Sandbox.\n\u200f- \u0627\u0633\u062a\u063a\u0644\u0627\u0644 \u0627\u0644\u0640 XPC services \u0627\u0644\u062a\u064a \u062a\u0645\u0644\u0643 entitlements \u062e\u0627\u0635\u0629 (\u0645\u062b\u0644 com.apple.security.exception.files.absolute-location.read-only).\n\u200f- \u0627\u0644\u062a\u0631\u0643\u064a\u0632 \u0639\u0644\u0649 \u0627\u0644\u0640 deserialization bugs \u0641\u064a NSXPCConnection.\n\n\u200f2. JIT-Spray \u0648PAC Bypass:\n\u200f- \u0627\u0644\u0640 JIT compilers \u062a\u064f\u0646\u0634\u0626 \u0643\u0648\u062f \u0642\u0627\u0628\u0644 \u0644\u0644\u062a\u0646\u0641\u064a\u0630 \u0628\u062f\u0648\u0646 PAC signatures.\n\u200f- \u0627\u0633\u062a\u0647\u062f\u0627\u0641 \u0627\u0644\u0640 JavaScriptCore JIT area \u0644\u0643\u062a\u0627\u0628\u0629 shellcode.\n\u200f- \u0627\u0633\u062a\u062e\u062f\u0627\u0645 bfxil instruction \u0644\u062d\u0642\u0646 bits \u0641\u064a \u0627\u0644\u0640 pointer \u062f\u0648\u0646 \u0625\u0641\u0633\u0627\u062f \u0627\u0644\u0640 PAC.\n\n\u200f// \u0645\u062b\u0627\u0644 \u0639\u0644\u0649 JIT allocation bypass\nconst jit_region = new ArrayBuffer(4096);\n\u200f// \u0627\u0644\u0640 JIT region \u0644\u0627 \u062a\u062e\u0636\u0639 \u0644\u0640 PAC verification\n\u200f// \u064a\u0645\u0643\u0646 \u062a\u0646\u0641\u064a\u0630 shellcode \u0645\u0646\u0647\u0627 \u0645\u0628\u0627\u0634\u0631\u0629\n\n3. MTE Coarse-Grained Bypass:\n\u200f- MTE \u0641\u064a iOS \u064a\u064f\u0633\u062a\u062e\u062f\u0645 \u062d\u0627\u0644\u064a\u0627\u064b \u0628\u0640 \"asymmetric mode\" (checking only on certain operations).\n\u200f- \u0627\u0633\u062a\u0647\u062f\u0627\u0641 \u0627\u0644\u0640 unchecked paths \u0641\u064a \u0627\u0644\u0640 kernel extensions.\n\u200f- \u0627\u0644\u062a\u0631\u0643\u064a\u0632 \u0639\u0644\u0649 \u0627\u0644\u0640 IOKit drivers \u0627\u0644\u062a\u064a \u0644\u0627 \u062a\u064f\u0637\u0628\u0642 MTE \u0628\u0634\u0643\u0644 \u0643\u0627\u0645\u0644.\n\n---\n\nKERNEL PRIVILEGE ESCALATION \u2014 PE_MAIN.JS\n\nTARGET VULNERABILITIES IN IOS 19+\n\u200f1. Use-After-Free \u0641\u064a IOKit:\n\u200f- \u0627\u0644\u0640 IOKit objects \u062a\u064f\u062f\u0627\u0631 \u0628\u0640 reference counting.\n\u200f- \u0625\u0645\u0643\u0627\u0646\u064a\u0629 \u062d\u062f\u0648\u062b UAF \u0639\u0646\u062f race conditions \u0641\u064a \u0627\u0644\u0640 device attachment/detachment.\n\u200f- CVE-2024-23222 \u0645\u062b\u0627\u0644 \u0639\u0644\u0649 IOKit UAF \u062a\u0645 \u0625\u0635\u0644\u0627\u062d\u0647 \u0645\u0624\u062e\u0631\u0627\u064b.\n\n\u200f2. Integer Overflow \u0641\u064a Kernel Memory Allocator:\n\u200f- \u062f\u0627\u0644\u0629 kalloc() \u062a\u0639\u062a\u0645\u062f \u0639\u0644\u0649 size parameter.\n\u200f- Integer overflow \u064a\u0624\u062f\u064a \u0625\u0644\u0649 allocation \u0623\u0635\u063a\u0631 \u0645\u0646 \u0627\u0644\u0645\u062a\u0648\u0642\u0639.\n\u200f- \u062a\u0624\u062f\u064a \u0625\u0644\u0649 heap overflow \u0639\u0646\u062f \u0646\u0633\u062e \u0627\u0644\u0628\u064a\u0627\u0646\u0627\u062a.\n\n\u200f3. Type Confusion \u0641\u064a XNU Scheduler:\n\u200f- \u0627\u0644\u0640 thread termination races \u0642\u062f \u062a\u0624\u062f\u064a \u0625\u0644\u0649 type confusion.\n\u200f- \u0627\u0644\u0640 task_struct \u064a\u064f\u0639\u0627\u062f \u0627\u0633\u062a\u062e\u062f\u0627\u0645\u0647 \u0642\u0628\u0644 \u0627\u0644\u062a\u0646\u0638\u064a\u0641 \u0627\u0644\u0643\u0627\u0645\u0644.\n\nPE_MAIN.JS MODIFICATION APPROACH\n\u200f1. Heap Feng Shui \u0645\u062d\u062f\u062b:\n\u200f- \u062a\u062d\u0636\u064a\u0631 \u0627\u0644\u0640 heap layout \u0644\u062a\u062d\u0642\u064a\u0642 \u0648\u0636\u0639 \u0627\u0644\u0640 target object \u0628\u062c\u0648\u0627\u0631 object \u064a\u062a\u062d\u0643\u0645 \u0641\u064a\u0647 \u0627\u0644\u0645\u0647\u0627\u062c\u0645.\n\u200f- \u0627\u0633\u062a\u062e\u062f\u0627\u0645 \u0627\u0644\u0640 IOSurface objects \u0643\u0640 \"spray objects\" \u0644\u0623\u0646\u0647\u0627 \u0642\u0627\u0628\u0644\u0629 \u0644\u0644\u062a\u062d\u0643\u0645 \u0645\u0646 userspace.\n\n\u200f// \u062a\u062c\u0645\u064a\u0639 IOSurface \u0644\u0644\u062a\u062d\u0643\u0645 \u0628\u0640 heap layout\nIOSurfaceRef surfaces[256];\nfor (int i = 0; i < 256; i++) {\n    surfaces[i] = IOSurfaceCreate(properties);\n\u200f    // Trigger free \u0641\u064a \u0646\u0642\u0637\u0629 \u0645\u062d\u062f\u062f\u0629\n}\n\n2. Zone Poisoning:\n\u200f- \u0627\u0644\u0640 kernel \u064a\u0641\u0635\u0644 \u0623\u0646\u0648\u0627\u0639 \u0645\u062e\u062a\u0644\u0641\u0629 \u0645\u0646 objects \u0641\u064a zones \u0645\u0646\u0641\u0635\u0644\u0629.\n\u200f- \u0625\u063a\u0631\u0627\u0642 zone \u0645\u062d\u062f\u062f \u0628\u0640 fake objects.\n\u200f- \u0639\u0646\u062f \u062d\u062f\u0648\u062b UAF\u060c \u0627\u0644\u0640 freed slot \u064a\u064f\u0639\u0627\u062f \u0627\u0633\u062a\u062e\u062f\u0627\u0645\u0647 \u0645\u0646 \u0646\u0641\u0633 zone.\n\n3. Kernel Read Primitive:\n\u200f- \u0642\u0628\u0644 \u0645\u062d\u0627\u0648\u0644\u0629 \u0627\u0644\u0643\u062a\u0627\u0628\u0629\u060c \u064a\u062c\u0628 \u0627\u0644\u062d\u0635\u0648\u0644 \u0639\u0644\u0649 \u0642\u062f\u0631\u0629 \u0642\u0631\u0627\u0621\u0629 \u0639\u0634\u0648\u0627\u0626\u064a\u0629 \u0645\u0646 kernel memory.\n\u200f- \u0627\u0633\u062a\u062e\u062f\u0627\u0645 task_ports leaks \u0644\u0644\u062d\u0635\u0648\u0644 \u0639\u0644\u0649 kernel addresses.\n\u200f- \u0627\u0644\u062a\u062e\u0644\u064a \u0639\u0646 hard-coded addresses (kASLR \u064a\u062c\u0639\u0644\u0647\u0627 \u063a\u064a\u0631 \u0645\u062c\u062f\u064a\u0629).\n\n---\n\nOBFUSCATION TECHNIQUES\n\nMETAMORPHIC VS POLYMORPHIC\n1. Metamorphic Code:\n\u200f- \u064a\u0639\u064a\u062f \u0643\u062a\u0627\u0628\u0629 \u0646\u0641\u0633\u0647 \u0628\u0634\u0643\u0644 \u0645\u062e\u062a\u0644\u0641 \u0643\u0644\u064a\u0627\u064b \u0645\u0639 \u0643\u0644 \u062a\u0646\u0641\u064a\u0630.\n\u200f- \u064a\u063a\u064a\u0631 \u0627\u0644\u0628\u0646\u064a\u0629 \u0627\u0644\u0645\u0646\u0637\u0642\u064a\u0629 \u062f\u0648\u0646 \u062a\u063a\u064a\u064a\u0631 \u0627\u0644\u0648\u0638\u064a\u0641\u0629.", "creation_timestamp": "2026-08-28T13:00:05.612791Z"}