diff --git a/README.md b/README.md index e0b6771..80bd2b2 100644 --- a/README.md +++ b/README.md @@ -1,41 +1,34 @@ -# CVE-2025-31200 – iOS AudioConverterService Zero-Click RCE +# CVE-2025-31200 & CVE-2025-31201 | iMessage Zero-Click RCE Chain -Public disclosure of CVE-2025-31200 – a zero-click remote code execution (RCE) vulnerability in Apple's iOS 18.X, specifically within the `AudioConverterService` component. The vulnerability is triggered by a malicious audio file delivered via iMessage or SMS, requiring no user interaction. +Public disclosure of two linked vulnerabilities in Apple's iOS 18.x: + +- **CVE-2025-31200** — Heap corruption in CoreAudio’s `AudioConverterService`, triggered by a malicious audio file delivered via iMessage. Zero-click, no user interaction required. +- **CVE-2025-31201** — Pointer Authentication (PAC) bypass in the RPAC path, enabling reliable kernel exploitation once arbitrary R/W is achieved. --- -## Disclosure & Patch Timeline +## Disclosure & Patch Timeline - **Initial Report Date:** January 21, 2025 -- **Reported To:** US-CERT (Tracking ID: VRF#25-01-MPVDT) +- **Reported To:** Apple & US-CERT (Tracking ID: VRF#25-01-MPVDT) - **Patched By Apple:** Silently resolved in **iOS 18.4.1**, released **April 16, 2025** -- **CVE Assignment:** Identifier **CVE-2025-31200** is used publicly due to lack of MITRE response -- **Acknowledgment:** No public credit or acknowledgment provided by Apple or MITRE as of May 18, 2025 +- **CVE Assignment:** Identifiers **CVE-2025-31200** and **CVE-2025-31201** were assigned publicly due to lack of MITRE response -Due to the severity of the vulnerability, prolonged silence from relevant stakeholders, and lack of credit or transparency post-patch, this repository is being published to inform the security community and support defensive mitigation. +Due to the severity, prolonged silence from relevant stakeholders, and absence of acknowledgment post-patch, this repository is published to inform the security community and support defensive mitigation. --- -## Affected Systems +## Affected Systems + +- **iOS Versions:** Zero-day until patched in **iOS 18.4.1 (April 16, 2025)** +- **Primary Vulnerable Component:** `AudioConverterService` (CoreAudio) via iMessage / SMS delivery +- **Chained Component:** RPAC / Pointer Authentication (PAC bypass, CVE-2025-31201) +- **Post-Exploitation Impact:** Wireless subsystem manipulation and CryptoTokenKit abuse (no CVE assigned) -- **Product:** iPhone 15 Pro Max (others likely affected) -- **iOS Versions:** iOS 18.2.1, iOS 18.3 Beta -- **Patched Version:** iOS 18.4.1 (April 16, 2025) -- **Vulnerable Component:** `AudioConverterService` via iMessage / SMS processing --- -## Contents -- `Remote-Audio-Exploit-iOS-15ProMax-iOS18x.md` – Full technical write-up including: - - Attack chain - - Simulated proof-of-concept (PoC) - - Log timeline and decrypted token leakage - - Privilege escalation and AWDL DoS impact - -No weaponized exploit code or malicious payloads are provided. This repository is for documentation and defense only. - ---- ## 🛡️ Disclaimer