---
id: 8683
title: "[CVE-2019-6225] voucher_swap: Exploiting MIG reference counting in iOS 12"
cve: CVE-2019-6225
source_domain: projectzero.google
source_url: "https://projectzero.google/2019/01/voucherswap-exploiting-mig-reference.html"
published_at: "2019-01-29T00:00:00Z"
tags: ["cve", "xnu", "project-zero", "voucher-swap", "mig"]
phying_url: "https://phying.com/item/8683"
lang: en
---

# [CVE-2019-6225] voucher_swap: Exploiting MIG reference counting in iOS 12

## Summary

In this post I'll describe how I discovered and exploited CVE-2019-6225, a MIG reference counting vulnerability in XNU's task_swap_mach_voucher() function. We'll see how to exploit this bug on iOS 12.1.2 to build a fake kernel task port, giving us the ability to read and write arbitrary kernel memory. (This bug was independently discovered by @S0rryMybad.) In a later post, we'll look at how to use this bug as a starting point to analyze and bypass Apple's implementation of ARMv8.3 Pointer Authentication (PAC) on A12 devices like the iPhone XS.

## Intelligence Metadata

- **Sources:** projectzero.google
- **CVE:** CVE-2019-6225
- **Published:** 2019-01-29T00:00:00Z
- **Original:** https://projectzero.google/2019/01/voucherswap-exploiting-mig-reference.html
- **Phying News:** https://phying.com/item/8683