Symbolic Link Vulnerability

By restoring files, directories and symlinks to the iOS device, the path is carefully checked, so that no write accesses outside of certain domains are possible. By creating a symlink that points to somewhere else, it is possible to overcome this limitation.

This vulnerability has been fixed in iOS 7.1b2.

Usage in evasi0n jailbreak[edit]

In the case of evasi0n, the following files, directories and symlinks are restored, all in the Media Domain:

directory: Media/
directory: Media/Recordings/
symlink: Media/Recordings/.haxx pointing to /var/mobile
directory: Media/Recordings/.haxx/DemoApp.app/
several files in Media/Recordings/.haxx/DemoApp.app/, Info.plist, DemoApp, Icon.png, Icon@2x.png, Icon-72.png, Icon-72@2x.png
file: Media/Recordings/.haxx/Library/Caches/com.apple.mobile.installation.plist

This results in the following directory and file structure:

/var/mobile/Media/Recordings/ (folder)
/var/mobile/Media/Recordings/.haxx (symlink)

/var/mobile/DemoApp.app/Info.plist
/var/mobile/DemoApp.app/DemoApp
/var/mobile/DemoApp.app/Icon.png
/var/mobile/DemoApp.app/Icon@2x.png
/var/mobile/DemoApp.app/Icon-72.png
/var/mobile/DemoApp.app/Icon-72@2x.png

/var/mobile/Library/Caches/com.apple.mobile.installation.plist

References[edit]

Accuvant Labs analysis of evasi0n [Archived 2013-12-27 at the Wayback Machine]

v t e Exploits
Exploits	0x24000 Segment Overflow ARM Exception Vector Info Leak ARM7 Go AT+FNS AT+XAPP Vulnerability AT+XEMN Heap Overflow AT+XLOG Vulnerability AT+stkprof alloc8 Exploit amfid Lazy Binding Exploit amfid Text Relocation Exploit BPF_STX Kernel Write Exploit blackbird Exploit CVE-2013-0964 CVE-2021-30773 CVE-2021-30807 CVE-2021-30883 checkm8 Exploit CoreTrust Root Certificate Validation Vulnerability De Rebus Antiquis diags (iBoot command) Dual Boot Exploit Dynamic memmove() locating Fakeblank HFS Heap Overflow HFS Legacy Volume Name Stack Buffer Overflow iBoot Environment Variable Overflow IOPlatformArgs leak iOS 5 HFS Heap Buffer Overflow IOSurface Kernel Exploit IOUSBDeviceFamily Vulnerability IPSF Incomplete Codesign Exploit iran JerrySIM Kernel memory write via ROP gadget launchd.conf Untether libTiff Exploit limera1n Exploit MacDirtyCow Malformed CFF Vulnerability Malformed PairRequest Minus 0x20000 with Back Extend Erase Minus 0x400 MobileBackup Copy Exploit ndrv_setspec() Integer Overflow Overlapping Segment Attack Packet Filter Kernel Exploit posix_spawn kernel information leak Psychic Paper ... further results
Patches	/private/etc/fstab AMFI Binary Trust Cache Patch ASR Crazeles hgsp4 patch Hunnypot Kernel Patches PE_i_can_has_debugger Patch Sandbox Patch Signature Check Patch tfp0 patch vm_map_enter Patch vm_map_protect Patch

Usage in evasi0n jailbreak[edit]

See Also[edit]

References[edit]