CalvinBackup/iOS-Attack-Chain-CVE-2025-31200-CVE-2025-31201
1
0
Fork 0
mirror of https://github.com/JGoyd/iOS-Attack-Chain-CVE-2025-31200-CVE-2025-31201.git synced 2026-09-23 17:00:48 +02:00
Code Issues Packages Projects Releases Wiki Activity

Update README.md

Browse Source
This commit is contained in:
Joseph Goydish II
2025-11-12 17:38:35 -05:00
committed by GitHub
parent 8193cca16c
commit 6c515df183
1 changed files with 4 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files
README.md
+4 -7
View File
@@ -17,12 +17,10 @@ In post‑pivot testing, misuse of CryptoTokenKit signing operations was observe
---
## Observed Post-Compromise Behavior
- **CryptoTokenKit / identityservicesd signing operations** invoked from compromised context without UI prompts.
*Important:* No Secure Enclave key material was exported; observed misuse is limited to signing operations.
- **System instability / PME behavior** — Media decode failures correlated with PME enforcement logs, GPU link errors, and mediaplaybackd variant switching, occasionally causing device stalls.
## Observed Post‑Compromise Behavior
---
- **Unauthorized signing:** CryptoTokenKit / identityservicesd invoked signing operations from a compromised context without UI prompts (no Secure Enclave key material exported).
- **System instability:** Media decode failures correlated with PME enforcement logs, GPU/AppleDCP link errors, mediaplaybackd variant‑switch loops and occasional launchd/SoC stalls.
## Scope of Impact
@@ -32,9 +30,8 @@ In post‑pivot testing, misuse of CryptoTokenKit signing operations was observe
- **Primary component:** AudioConverterService (CoreAudio AAC decoder) — inMagicCookie heap corruption (CVE‑2025‑31200)
- **Chained component:** AppleBCMWLAN.dext — AMPDU handling → kernel escalation (CVE‑2025‑31201)
- **Privileges required:** None (initial); kernel achieved post‑chain
- **Immediate impact:** Unauthorized Secure Enclave–backed signing via CryptoTokenKit (no key exfiltration observed)
- **Collateral/system impact:** Wireless token manipulation (AWDL/IDS), PME/GPU variant‑switch stalls, launchd SoC stalls
- **Impact summary:** Integrity (unauthorized signing, token/device impersonation) + Availability (system stalls); Confidentiality — no key export
---
## Disclosure Timeline