CVE-2021-30883

On 2021, Apple released iOS 15.0.2 with a fix for CVE-2021-30883, a vulnerability in IOMobileFrameBuffer which allows kernel code execution, and has been exploited in the wild according to Apple. The bug is also present in iOS 15.1 betas 1, 2 and 3 (beta 4 patched it).

Note that despite also involving IOMFB, this is a different vulnerability than CVE-2021-30807 which was fixed in 14.7.1.

Saar Amar quickly bindiff'd the kernel and wrote a blog post and PoC about this vulnerability.

Unlike CVE-2021-30807, this vulnerability is apparently exploitable from the app sandbox without any special entitlement.

Saar's PoC works on A10X, A11, A12, and A13 devices. Apparently, A14/A15 moved this code to the DCP. A small change to the PoC makes it panic the DCP coprocessor, which then panics the iOS kernel, but this is unlikely to allow exploiting the kernel.