Abstract

IOSurface is a fundamental element in iOS/macOS. In system wide its id starts from 1 and increases progressively, while IOSurface 0 doesn't exist. However, when users lookup IOSurface 0, the system doesn't treat the lookup request as illegal. This feature exposes an eleet method for exploiting bugs. In this talk, I will show a case study by exploiting IOSurface 0, leading to type confusion, then info leak to bypass kASLR and finally code execution. Recently, new version of iOS has already mitigated the attack chain, especially after the introduction of A12 PAC and iOS 13. I will also analyze those mitigations and discuss about the way to bypass.