diff --git a/README.md b/README.md index bc93d4d..a671645 100644 --- a/README.md +++ b/README.md @@ -1,45 +1,59 @@ -# CVE-2025-31200 & CVE-2025-31201 iMessage Zero-Click RCE Chain +# CVE-2025-31200 & CVE-2025-31201 — iMessage Zero‑Click RCE Chain -Public disclosure of two linked vulnerabilities in Apple's iOS 18.x: +## Summary +This repository documents research into a zero‑click remote exploit chain affecting iOS 18.x. A malformed MP4 audio file delivered via iMessage triggers: -- **CVE-2025-31200** — Heap corruption in CoreAudio’s `AudioConverterService`, triggered by a malicious audio file delivered via iMessage. Zero-click, no user interaction required. -- **CVE-2025-31201** — Pointer Authentication (PAC) bypass in the RPAC path, enabling reliable kernel exploitation once arbitrary R/W is achieved. +1. **Heap corruption in CoreAudio (CVE‑2025‑31200)** — in AudioConverterService AAC decoding. +2. **Kernel escalation via AppleBCMWLAN/AMPDU handling (CVE‑2025‑31201)** — leads to kernel code execution. + +In post‑pivot testing, misuse of CryptoTokenKit signing operations was observed, invoking Secure Enclave–backed keys without interactive prompts. Apple patched the vulnerabilities in iOS 18.4.1. --- -## Disclosure & Patch Timeline - -- **Initial Report Date:** (found "in the wild") Dec 20, 2024 -- **Re-Reported To:** Apple & US-CERT Jan 21, 2025 (Tracking ID: VRF#25-01-MPVDT) -- **Sent to Google Research Team:** April 11th, 2025 -- **Patched By Apple:** resolved in **iOS 18.4.1**, released **April 16, 2025** -- **CVE Assignment:** Identifiers **CVE-2025-31200** and **CVE-2025-31201** were assigned publicly due to lack of MITRE response - -Due to the severity, prolonged silence from relevant stakeholders, and absence of acknowledgment post-patch, this repository is published to inform the security community and support defensive mitigation. - -## Malicious Working Exploit: https://www.dropbox.com/scl/fi/oerpnhq1ui3xfswsszfh2/Audio-clip.amr?rlkey=7n54m1o84poezyipxvd2f9slx&e=1&st=b1tkonvr&dl=0 ---- - -## Affected Systems - -- **iOS Versions:** Zero-day until patched in **iOS 18.4.1 (April 16, 2025)** -- **Primary Vulnerable Component:** `AudioConverterService` (CoreAudio) via iMessage / SMS delivery -- **Chained Component:** RPAC / Pointer Authentication (PAC bypass, CVE-2025-31201) -- **Post-Exploitation Impact:** Wireless subsystem manipulation and CryptoTokenKit abuse (no CVE assigned) - +## Verified Behavior +- **CVE‑2025‑31200 (CoreAudio)** — Heap corruption in AudioConverterService AAC decoder via malformed `inMagicCookie`. Zero-click, no user interaction required. +- **CVE‑2025‑31201 (AppleBCMWLAN)** — Kernel privilege escalation following CoreAudio corruption. Fully reproducible on affected devices/builds. +- **Zero-click delivery vector** — Malicious media processed by iMessage while device is locked. --- - - -## 🛡️ Disclaimer - -This report is released in the interest of public safety, transparency, and to support defenders and researchers. All information is based on independent research. No offensive code is included. The author remains open to coordination with trusted parties for validation and response. +## Observed Post-Compromise Behavior +- **CryptoTokenKit / identityservicesd signing operations** invoked from compromised context without UI prompts. + *Important:* No Secure Enclave key material was exported; observed misuse is limited to signing operations. +- **System instability / PME behavior** — Media decode failures correlated with PME enforcement logs, GPU link errors, and mediaplaybackd variant switching, occasionally causing device stalls. --- -## Why This Matters +## Affected Software & Devices +- **iOS versions:** 18.0 — 18.4 (patched in iOS 18.4.1) +- **Patched by Apple:** iOS 18.4.1 (April 16, 2025) — CVE‑2025‑31200 and CVE‑2025‑31201 fixed. +- **Primary vulnerable component:** AudioConverterService (CoreAudio) via iMessage / SMS. +- **Chained component:** RPAC / Pointer Authentication (PAC bypass, CVE‑2025‑31201). +- **Post-exploitation impact:** Wireless subsystem manipulation and CryptoTokenKit signing misuse (no key exfiltration observed). -This zero-click chain gives attackers silent, full device control. With kernel-level access and documented keychain exfiltration, an attacker can drain crypto wallets by stealing stored keys, intercept 2FA codes and messages to take over accounts, authorize payments or transfers without prompts, and activate mic, camera, or GPS to surveil you — all without any user interaction. +--- -In short, your phone can be turned into a stealthy vault-breaker and spy, and you may never see a warning. +## Disclosure Timeline +- Found in the wild: **Dec 20, 2024** +- Reported to Apple & US‑CERT: **Jan 21, 2025** (Tracking ID: VRF#25-01-MPVDT) +- Shared with Google Project Zero / Research Team: **Apr 11, 2025** +- Patched by Apple: **Apr 16, 2025** (iOS 18.4.1) +- CVE assignments: **CVE‑2025‑31200** and **CVE‑2025‑31201** + +--- + +## Impact Statement +An attacker who can trigger this chain remotely can achieve kernel-level compromise and co-opt Secure Enclave–backed signing primitives without exporting key material. This can enable impersonation of device identities and forgery of identity-bound tokens. Severity is high, and runtime hardening and mitigation are recommended. + +--- + +## Recommendations +- Enforce BlastDoor / attachment inspection for all messages; do not bypass based on sender metadata. +- Apply rigorous input validation for decoder parameters (e.g., inMagicCookie/codec metadata). +- Implement runtime attestation for CryptoTokenKit / Secure Enclave signing operations to verify caller integrity and entitlements. +- Harden wireless driver surfaces and IOKit entrypoints against malformed kernel data. + +--- + +## License & Disclaimer +Released for defensive research and further study. \ No newline at end of file