CalvinBackup/iOS-Attack-Chain-CVE-2025-31200-CVE-2025-31201
1
0
Fork 0
mirror of https://github.com/JGoyd/iOS-Attack-Chain-CVE-2025-31200-CVE-2025-31201.git synced 2026-09-23 08:50:48 +02:00
Code Issues Packages Projects Releases Wiki Activity

Update README.md

Browse Source
This commit is contained in:
Joseph Goydish II
2025-08-24 15:52:32 -04:00
committed by GitHub
parent e3dfd91f67
commit 7dce6bac81
1 changed files with 15 additions and 22 deletions
Download Patch File Download Diff File Expand all files Collapse all files
README.md
+15 -22
View File
@@ -1,41 +1,34 @@
# CVE-2025-31200 – iOS AudioConverterService Zero-Click RCE
# CVE-2025-31200 & CVE-2025-31201 | iMessage Zero-Click RCE Chain
Public disclosure of CVE-2025-31200 – a zero-click remote code execution (RCE) vulnerability in Apple's iOS 18.X, specifically within the `AudioConverterService` component. The vulnerability is triggered by a malicious audio file delivered via iMessage or SMS, requiring no user interaction.
Public disclosure of two linked vulnerabilities in Apple's iOS 18.x:
- **CVE-2025-31200** — Heap corruption in CoreAudio’s `AudioConverterService`, triggered by a malicious audio file delivered via iMessage. Zero-click, no user interaction required.
- **CVE-2025-31201** — Pointer Authentication (PAC) bypass in the RPAC path, enabling reliable kernel exploitation once arbitrary R/W is achieved.
---
## Disclosure & Patch Timeline
## Disclosure & Patch Timeline
- **Initial Report Date:** January 21, 2025
- **Reported To:** US-CERT (Tracking ID: VRF#25-01-MPVDT)
- **Reported To:** Apple & US-CERT (Tracking ID: VRF#25-01-MPVDT)
- **Patched By Apple:** Silently resolved in **iOS 18.4.1**, released **April 16, 2025**
- **CVE Assignment:** Identifier **CVE-2025-31200** is used publicly due to lack of MITRE response
- **Acknowledgment:** No public credit or acknowledgment provided by Apple or MITRE as of May 18, 2025
- **CVE Assignment:** Identifiers **CVE-2025-31200** and **CVE-2025-31201** were assigned publicly due to lack of MITRE response
Due to the severity of the vulnerability, prolonged silence from relevant stakeholders, and lack of credit or transparency post-patch, this repository is being published to inform the security community and support defensive mitigation.
Due to the severity, prolonged silence from relevant stakeholders, and absence of acknowledgment post-patch, this repository is published to inform the security community and support defensive mitigation.
---
## Affected Systems
## Affected Systems
- **iOS Versions:** Zero-day until patched in **iOS 18.4.1 (April 16, 2025)**
- **Primary Vulnerable Component:** `AudioConverterService` (CoreAudio) via iMessage / SMS delivery
- **Chained Component:** RPAC / Pointer Authentication (PAC bypass, CVE-2025-31201)
- **Post-Exploitation Impact:** Wireless subsystem manipulation and CryptoTokenKit abuse (no CVE assigned)
- **Product:** iPhone 15 Pro Max (others likely affected)
- **iOS Versions:** iOS 18.2.1, iOS 18.3 Beta
- **Patched Version:** iOS 18.4.1 (April 16, 2025)
- **Vulnerable Component:** `AudioConverterService` via iMessage / SMS processing
---
## Contents
- `Remote-Audio-Exploit-iOS-15ProMax-iOS18x.md` – Full technical write-up including:
- Attack chain
- Simulated proof-of-concept (PoC)
- Log timeline and decrypted token leakage
- Privilege escalation and AWDL DoS impact
No weaponized exploit code or malicious payloads are provided. This repository is for documentation and defense only.
---
## 🛡️ Disclaimer