mirror of
https://github.com/JGoyd/Glass-Cage-iOS18-CVE-2025-24085-CVE-2025-24201.git
synced 2026-02-12 12:52:56 +00:00
Update README.md
Updated CVE entries and added details to the exploit chain.
This commit is contained in:
committed by
GitHub
parent
1451559c2d
commit
393d0b38e8
21
README.md
21
README.md
@@ -1,14 +1,15 @@
|
||||
# Glass Cage: Zero-Click PNG Exploit Chain for iOS 18.2.1
|
||||
|
||||
**CVE-2025-24201** – WebKit Remote Code Execution
|
||||
**CVE-2025-24085** – Core Media Privilege Escalation
|
||||
|
||||
**Reported to Apple:** December 18, 2024
|
||||
- **CVE-2025-43300:** O.o.B Wrrite in ImageIO
|
||||
- **CVE-2025-24201:** WebKit Remote Code Execution
|
||||
- **CVE-2025-24085:** Core Media Privilege Escalation
|
||||
|
||||
**Patched:** Jan-March 2025
|
||||
|
||||
**Tested On:** iPhone 14 Pro Max (iOS 18.2.1)
|
||||
|
||||
[VirusTotal Analysis (Verified Hash)
|
||||
](https://www.virustotal.com/gui/file/f1af3b4fd9f3f08253af21e4df4ea6bb35a135df0805d176238f26de80e8d167)
|
||||
|
||||
---
|
||||
|
||||
## Summary
|
||||
@@ -29,19 +30,17 @@ https://ia600508.us.archive.org/8/items/cve-2025-24085-24201/cve%202025-24085%3B
|
||||
|
||||
1. **Malicious PNG Creation**
|
||||
- Embedded HEIF payloads with malformed EXIF fields
|
||||
- Triggers heap corruption in `ATXEncoder`
|
||||
|
||||
- Triggers heap corruption in `ATXEncoder` (CVE-2025-43300)
|
||||
2. **Silent Trigger via iMessage**
|
||||
- File auto-processed by `MessagesBlastDoorService` (CVE-2025-43300)
|
||||
- File auto-processed by `MessagesBlastDoorService`
|
||||
- RCE achieved through WebKit (CVE-2025-24201)
|
||||
|
||||
3. **Sandbox Escape**
|
||||
- WebKit bypasses resource isolation to access private assets
|
||||
|
||||
4. **Privilege Escalation**
|
||||
- Core Media flaw (CVE-2025-24085) enables kernel access
|
||||
- Exploits `mediaplaybackd`, `codecctl`, and `IOHIDInterface`
|
||||
|
||||
- Core Media flaw enables kernel access
|
||||
- Exploits `mediaplaybackd`, `codecctl`, and `IOHIDInterface` (CVE-2025-24085)
|
||||
5. **Persistence and Bricking**
|
||||
- Injects rogue daemons via `launchd`
|
||||
- Hijacks network through `wifid`
|
||||
|
||||
Reference in New Issue
Block a user