ziVA

vendor:

iOS

by:

Adam Donenfeld

7,8

CVSS

HIGH

iOS kernel exploit

N/A

CWE

Product Name: iOS

Affected Version From: iOS 10.3.1

Affected Version To: iOS 10.3.1

Patch Exists: NO

Related CWE: N/A

CPE: N/A

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: iOS

2017

ziVA is an iOS kernel exploit designated to work on all 64-bit iOS devices <= 10.3.1. It requires offsets for each iOS device and version, which can be acquired from AppleAVEDriver. Sandbox escape exploits have been released by P0, which means this can be used to completely compromise a kernel, and a step towards a full jailbreak. It is a crucial part in a Jailbreak chain, but this never aimed to become a Jailbreak.

Mitigation:

N/A

Source

Exploit-DB raw data:

Sources:
https://github.com/doadam/ziVA
https://blog.zimperium.com/ziva-video-audio-ios-kernel-exploit/

ziVA

An iOS kernel exploit designated to work on all 64-bit iOS devices <= 10.3.1

More general information

https://blog.zimperium.com/zimperium-zlabs-ios-security-advisories/

https://blog.zimperium.com/ziva-video-audio-ios-kernel-exploit/

Offsets modifications for other iOS devices

Like a lot (if not most) of the iOS kernel exploits, this also requires offsets for each iOS device and version. Those will be posted in the close future (when I get more time) but should be acquired from AppleAVEDriver (you can get a hint on the offsets from the comments above them).

Sandbox escape

Like mentioned, AppleAVEDriver direct access requires sandbox escape (either mediaserverd sandbox context or no sandbox at all). Fortunately, Sandbox escape exploits have been released by P0, which means this can be used to completely compromise a kernel, and a step towards a full jailbreak.

Is it a Jailbreak?

This is a crucial part in a Jailbreak chain, but this never aimed to become a Jailbreak.

Is this going to be a jailbreak?

Maybe, if someone wants to work on that

Credits

Credit for finding the vulnerabilities, chaining them together, writing the exploit go to Adam Donenfeld (@doadam). Special thanks to Zuk Avraham (@ihackbanme), Yaniv Karta (@shokoluv) and the rest of the Zimperium team for the opportunity (and the paycheck).


Proof of Concept:
https://github.com/doadam/ziVA
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/42555.zip