hardbird Exploit

hardbird

Vulnerability in SEPROM
Vulnerable in	A7
Disclosed	26 September 2023 (2023-09-26)
Discovered by	Proteas

The hardbird exploit is a SEPROM exploit that is currently known to be capable of executing unsigned code on the SEPs of devices with the A7 chip or any of its variants. This exploit can only function in combination with an AP BootROM exploit such as checkm8 or an iBoot exploit, as the SEP needs to be in SEPROM for the exploit to work.

The vulnerability

The vulnerability itself is quite similar to the blackbird Exploit, which uses a bug relating to the setting of TZ0 registers, except that instead of the bug being a loss of information during a shift, as A7 doesn't ignore the higher bits set in the TZ0/1 registers, and nor does it error out over the invalid input, it allows the memory channel selectors to be modified by an attacker, thus being an input validation issue during channel selection. As Apple "fixed" this bug by shifting the registers, the blackbird exploit became exploitable instead.