Over The Air - Vol. 2, Pt. 3: Exploiting The Wi-Fi Stack on Apple Devices

Part two of Project Zero's Over The Air Vol. 2 series, focusing on the firmware running on Broadcom's Wi-Fi SoC in the iPhone 7 as a step toward over-the-air exploitation.

Part two of Project Zero's Over The Air research, escalating from code execution on Broadcom's Wi-Fi SoC to remote kernel code execution on the host.

Project Zero revisits Broadcom's Wi-Fi stack through Apple devices, mapping new attack surfaces and building toward a full over-the-air exploit chain against iPhones.

The initial primitive gained from the vulnerability is an absolute address dereference in which the read value is afterwards used as an ObjC object. As such, some knowledge of the target address space is required in order to exploit this vulnerability for remote code execution. This blog post describes a way to defeat ASLR remotely without any additional information disclosure vulnerabilities.

Part one of Project Zero's Over The Air series, turning attention from application processors to Wi-Fi chips and finding flaws in Broadcom's widely used Wi-Fi stack.

A Google Project Zero post on a 'wild copy' parallel thread memory corruption bug and its exploitation.