CalvinBackup/iOS-Attack-Chain-CVE-2025-31200-CVE-2025-31201
1
0
Fork 0
mirror of https://github.com/JGoyd/iOS-Attack-Chain-CVE-2025-31200-CVE-2025-31201.git synced 2026-09-22 08:20:46 +02:00
Code Issues Packages Projects Releases Wiki Activity

Update Remote Crypto Attack Chain .md

Browse Source
This commit is contained in:
Joseph Goydish II
2025-11-11 18:31:21 -05:00
committed by GitHub
parent 080ffc5663
commit 7fd8d00902
1 changed files with 18 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files
Remote Crypto Attack Chain .md
+18 -8
View File
@@ -61,7 +61,17 @@ A malformed MP4 file triggers memory corruption in the AAC decoder by passing an
AudioConverterService ACMP4AACBaseDecoder.cpp: inMagicCookie=0x0, inMagicCookieByteSize=39
```
### 3. Kernel Privilege Escalation via AppleBCMWLAN (`CVE-2025-31201`)
### 3. IMTransferAgent decrypts and materializes the audio attachment
After CoreAudio begins processing, IMTransferAgent decrypts and writes the audio file to disk for further processing... evidence that the attachment reached the local decoder and system processing pipeline.
**Logs:**
```plaintext
IMTransferAgent Succeeded decrypting input URL: file:///var/mobile/tmp/com.apple.messages/<GUID_REDACTED>/.../<FILE_REDACTED>.m4a
```
### 4. Kernel Privilege Escalation via AppleBCMWLAN (`CVE-2025-31201`)
The corrupted memory leads to malformed AMPDU status handling in the Wi-Fi driver, granting the attacker kernel execution privileges.
@@ -72,19 +82,19 @@ IO80211ControllerMonitor::setAMPDUstat unhandled kAMPDUStat_ type 14
IO80211ControllerMonitor::setAMPDUstat unhandled kAMPDUStat_ type 13
```
### 4. Unauthorized Use of Secure Enclave Keys via CryptoTokenKit
### 5. Unauthorized Use of Secure Enclave Keys via CryptoTokenKit
With full system control, the attacker impersonates `identityservicesd` and invokes cryptographic operations using Secure Enclave–backed keys through CryptoTokenKit.
**Logs:**
With full system control, the attacker impersonates identityservicesd and invokes cryptographic operations using Secure Enclave backed keys through CryptoTokenKit.
```plaintext
identityservicesd Decrypting message <GUID_REDACTED> of encryption type "pair-tetra"
identityservicesd begins key management operations (sending/receiving decryption keys)
identityservicesd Query for encryption with IDs of remote/local devices
CryptoTokenKit operation:2 algo:algid:sign:ECDSA:digest-X962:SHA256
CryptoTokenKit <sepk:p256(d) kid=9a86778f7163e305> parsed for identityservicesd
CryptoTokenKit <sepk:p256(d) kid=<KID_REDACTED>> parsed for identityservicesd
```
No keys are exported, but signing operations are performed without authorization — effectively bypassing cryptographic isolation.
No keys are exported, but signing operations are performed without authorization... effectively bypassing cryptographic isolation.
---