A new exploit, dubbed Trigon, leverages CVE-2023032434 — an integer overflow vulnerability in Apple’s XNU virtual memory subsystem. This flaw, initially exploited in the Operation Triangulation campaign against Kaspersky researchers, exposes critical weaknesses in iOS’s memory management architecture.
The vulnerability stems from flawed validation in ‘mach_make_memory_entry_64,’ where an integer overflow in boundary checks allows attackers to create memory entries vastly exceeding device capacities.
Failing to account for 64-bit integer overflows permits attackers to manipulate memory boundaries.
By abusing this flaw, attackers gain unrestricted access to physical memory regions, bypassing Apple’s Kernel Text Read-Only (KTRR) and Page Protection Layer (PPL).
According to researchers, Trigon executes in four key phases. The first one is the creation of malicious memory entry creation. Using the ‘PurpleGfxMem’ region and IOSurface APIs, the exploit constructs a rogue memory entry, mapping arbitrary physical addresses into userspace, circumventing KTRR restrictions.
The second phase is the physical memory analysis. The iboot-handoff structure is parsed to determine the DRAM layout, allowing virtual-to-physical address translation.
The third phase involves kernel base discovery. Scanning RoRgn for Mach-O headers identifies the kernel’s physical base, enabling further exploitation.
In the last phase, the exploit hijacks IOSurface objects to achieve stable kernel memory read/write access while bypassing integrity checks.
Researchers discovered that the older ARMv8-A chips (A7-A9) require probabilistic kernel base guessing, while ARMv8.3-A (A12+) enforces stricter protections. Apple’s newer ‘Pointer Authentication Codes (PAC)’ and ‘Page Protection Layer (PPL)’ make arm64e-based devices resistant, though Trigon currently bypasses these on A10(X) devices, reports Gbhackers.
The exploit omits additional techniques such as WebKit renderer exploits and userspace PAC bypasses, which were used in ‘Operation Triangulation’ for broader privilege escalation.
Security experts recommend that enterprises enhance zero-day detection mechanisms to prevent such low-level attacks. While Apple is expected to release mitigations, the exploit’s GitHub release confirms support for A10(X) on iOS 13+, with adjustments required for newer SoCs.
In the News: Asian Football Confederation and 6 clubs suffer major data breach
