---
id: 8682
title: "Examining Pointer Authentication on the iPhone XS"
source_domain: projectzero.google
source_url: "https://projectzero.google/2019/02/examining-pointer-authentication-on.html"
published_at: "2019-02-01T00:00:00Z"
tags: ["research", "project-zero", "iphone-xs", "pointer-authentication", "a12"]
phying_url: "https://phying.com/item/8682"
lang: en
---

# Examining Pointer Authentication on the iPhone XS

## Summary

In this post I examine Apple's implementation of Pointer Authentication on the A12 SoC used in the iPhone XS, with a focus on how Apple has improved over the ARM standard. I then demonstrate a way to use an arbitrary kernel read/write primitive to forge kernel PAC signatures for the A keys, which is sufficient to execute arbitrary code in the kernel using JOP. The technique I discovered was (mostly) fixed in iOS 12.1.3. In fact, this fix first appeared in the 16D5032a beta while my research was still ongoing.

## Intelligence Metadata

- **Sources:** projectzero.google
- **Published:** 2019-02-01T00:00:00Z
- **Original:** https://projectzero.google/2019/02/examining-pointer-authentication-on.html
- **Phying News:** https://phying.com/item/8682