hardbird Exploit

hardbird

Vulnerability in SEPROM
Vulnerable in	A7
Disclosed	26 September 2023 (2023-09-26)
Discovered by	Proteas

The hardbird exploit is a SEPROM exploit that is currently known to be capable of executing unsigned code on the SEPs of devices with the A7 chip or any of its variants. This vulnerability can only be exploited when TZ0 is unlocked, such as when using an AP BootROM exploit such as checkm8, or an iBoot exploit.

The vulnerability

The vulnerability itself is quite similar to the blackbird Exploit, which uses a bug relating to the setting of TZ0 registers, except that instead of the bug being a loss of information during a shift, as A7 doesn't ignore the higher bits set in the TZ0/1 registers, and nor does it error out over the invalid input, it allows the memory channel selectors to be modified by an attacker, thus being an input validation issue during channel selection. As Apple "fixed" this bug by shifting the registers, the blackbird exploit became exploitable instead.