Skip to content

fix: UaF in boot-manifest-hash fallback#10

Open
ghost wants to merge 1 commit intoahl:masterfrom
lunaynx:fix-bmh-uaf
Open

fix: UaF in boot-manifest-hash fallback#10
ghost wants to merge 1 commit intoahl:masterfrom
lunaynx:fix-bmh-uaf

Conversation

@ghost
Copy link
Copy Markdown

@ghost ghost commented Apr 27, 2023

CFDataGetBytePtr doesn't return a copy. Somehow it happened to work fine up until iOS 16.3.1, but on iOS 16.4+ the early CFRelease causes the result to be all zeroes.

This isn't critical as it's just a fallback if it fails to get root-snapshot-name and that still works fine, but it's worth fixing anyway.

CFDataGetBytePtr doesn't return a copy. Somehow it happened to work fine
up until iOS 16.3.1, but on iOS 16.4+ the early CFRelease causes the
result to be all zeroes.

This isn't critical as it's just a fallback if it fails to get
root-snapshot-name and that still works fine, but it's worth fixing
anyway.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant