Apple acknowledges evad3r jailbreakers found 4 of 6 exploits fixed with iOS 6.1.3
Taking a closer look at the security release notes for Apple's latest iOS 6.1.3 update, it was discovered that the tech giant gave credit to the hackers behind the popular evasi0n jailbreak for finding four of six patched exploits.
Evad3rs leveraged some of the exploits to create the evasi0n jailbreak, which allowed iPhone 5 and iPad mini owners to "liberate" their devices. The untethered app was downloaded seven million times in its first four days of availability, leveraging exploits within iOS to grant users greater control over system-level functions usually reserved for first-party apps.
The newest iOS 6.1.3 reportedly breaks evasi0n, as reported in February when a beta version of the update was found to patch the exploits used for the jailbreak, but co-creator David Wang said there may be enough remaining flaws in the operating system to create an entirely new liberation tool.
The exploits discovered by evad3rs:
Impact: A local user may be able to execute unsigned code
Description: A state management issue existed in the handling of
Mach-O executable files with overlapping segments. This issue was
addressed by refusing to load an executable with overlapping
Impact: A local user may be able to determine the address of
structures in the kernel
Description: An information disclosure issue existed in the ARM
prefetch abort handler. This issue was addressed by panicking if the
prefetch abort handler is not being called from an abort context.
Impact: A local user may be able to change permissions on arbitrary
Description: When restoring from backup, lockdownd changed
permissions on certain files even if the path to the file included a
symbolic link. This issue was addressed by not changing permissions
on any file with a symlink in its path.
Impact: A local user may be able to execute arbitrary code in the
Description: The IOUSBDeviceFamily driver used pipe object pointers
that came from userspace. This issue was addressed by performing
additional validation of pipe object pointers.
A security flaw that allowed for the bypassing of an iPhone's lock screen, which turned out to be a logic issue in handling emergency calls, was found by Christopher Heffley of theMedium.ca, while a WebKit bug was discovered by Nils and Jon from MWR Labs working with HP TippingPoint's Zero Day Initiative.