[quenix]

Can someone ELI5 what this POC actually does? As someone with little experience w/ iOS internals or its kernel, I’m not sure what I’m looking at.

Does it run code as root? Write kernel memory?

[aj3]

Initial vulnerability is OOB read, but it can be leveraged to gain arbitrary r/w.

EDIT: source: https://saaramar.github.io/IOMobileFrameBuffer_LPE_POC/

[quenix]

Thanks for the write up.