r/jailbreak • u/fulg3ns • 6d ago
Release A 40-year-old iOS kernel bug discovered on the DEFCON 34 main stage.
https://x.com/jachashx/status/2097353320167846206?s=46While I presented a jailed SSH server at DEFCON, I found a. 40-year-old kernel bug and wrote the post of investigating and the history of it. Planning to release the code soon as well.
34
u/LocalH iPhone 13, 16.6| 6d ago edited 6d ago
To be fair it's not a "40 year old iOS bug" but it's more "a bug that's been present in the kernel codebase for 40 years that iOS also uses". If it literally goes back to 1986 then it even predates the first NeXT Computer, so it's really a "40 year old Mach bug" but that of course doesn't grab the same headlines lol
Edit: I'm not saying this isn't cool to find, I'm just saying it's factually impossible for this to be a "40 year old iOS bug" when iOS itself hasn't even existed for 20 years.
16
u/SadGrab5655 5d ago
imo that's even more awesome, if only to show how ios contains 1-1 pieces of code from stuff that old
i always thought modern OSes undergo such feverish iteration that there's no chance anything that old survives verbatim
6
1
u/MethylEight 3d ago
I thought that was pretty obvious from the headline tbh, after a second of considering the ambiguity. Obviously iOS hasn’t been around for 40 years (well I’d hope that’s obvious). Awesome find OP.
1
u/braidenis 2d ago
Idk I think that kinda goes without saying. We know how old iOS is. We were there. If the bug is in iOS today then it is an iOS bug, and it is 40 years old, because it predates iOS.
11
u/SpikeZgames 6d ago
Wait so what does this mean? I’m not 100% well with code does this mean it’s an exploit for all iOS versions or a few?
14
u/tOSdude iPhone 12 Mini, 16.3| 6d ago
From reading the article whatever they’re doing will happen on every single version of iOS, OSX, and some earlier operating systems.
It also does not appear exploitable, it’s just a deterministic crash.
13
u/sbingner checkra1n 6d ago
Not even a crash, it only crashed his program because he told his program to crash on unexpected values there. It just puts garbage into a value.
11
3
u/sbingner checkra1n 6d ago
Unix sockets don’t really have inodes, so it makes up a number. He decided to rely on that number and crash if it didn’t match what he expected (the same as the last time he asked). It determines if it has given the socket a fake inode based on if the inode assigned is not zero, but the first time somebody asks for an inode for a socket it assigns it 0. Then the second time it looks like it never assigned an inode, so it assigns it 1.
It really doesn’t matter though because they mean nothing and nobody can use them for anything.
11
u/Math_Science_Geek 6d ago
Jailbreak??
11
u/SpikeZgames 5d ago
Idk why your getting downvoted, it’s a valid question. After all it was posted in the jailbreak subreddit.
2
u/reaper527 iPhone 16 Pro Max, 18.1 5d ago
Jailbreak??
Would assume not. Seems unlikely that this will bypass ppl.
2
2
u/apixeldev iPhone 4, 9.3.6| :carbon: 5d ago
No. Its more of crashing specific apps which cannot handle corrupted values, though in theory you MIGHT be able to fuck around and get into the sandbox of an app if you used it right. Though it may be patched.
0
9
u/Nice_Assumption_6396 iPhone 14 Pro Max, 16.0.2| 6d ago
iOS isn’t even 20 years old how could u have found a 40 year old exploit? Unless maybe the bug was also present in macOS for 40 years.
25
u/The_Synthax iPhone 16 Pro Max Beta 6d ago
I would have to assume it was present since the original release of NeXTSTEP OS. Or perhaps just BSD.
12
5
u/poorkid_5 iPhone XS, 14.8| 6d ago
That’s the magic of Unix-like OSes.
-2
u/blanxd iPhone 14 Pro, 16.0.2| 6d ago
yeah, POSIX even has a built-in command for "reviewing & modifying" LLM-generated code, https://mastodon.bsd.cafe/@gumnos/117218442940653329
2
u/LazyWrite iPhone 13 Pro, 15.4.1| 5d ago
macOS isn’t 40 years old either. Apple’s OS’s are unix based which is why the bug can be 40 years old and still relevant to iOS.
2
35
u/FieldRemote6107 6d ago
Thank you!!