Hacker News new | past | comments | ask | show | jobs | submit login
Race you to the kernel (googleprojectzero.blogspot.com)
103 points by ingve on March 23, 2016 | hide | past | favorite | 7 comments



When I try to zoom in to read the rather small image illustrations on iOS MobileSafari, it just takes me to a different blog post. Going back again leaves a huge animgif running at the side of the page :( Please don't override scroll and zoom gestures :(



I always find these exploits interesting, since they show how Unix primitives are implemented in terms of Mach.


Could this be used to jailbreak iOS <9.3?


No, due to full userspace codesigning.


Then what can it do on iOS <9.3?

You can load any code you want by signing it yourself, so if this lets you escalate from there it should work for a jailbreak, although a more complex one than usual. IIRC some jailbreak releases used developer certificates to get the first code running.


From reddit:

>it doesn't yield kernel code execution (except on OS X where you can just load kexts with the right entitlement), and it requires execve (which you cannot call under the container sandbox profile on iOS).

https://www.reddit.com/r/jailbreak/comments/4bm9ka/news_proj...




Join us for AI Startup School this June 16-17 in San Francisco!

Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: