CVE-2024-23265: AppleDiskImages2, iOS 17.3.1 to 17.4
This repeats the patch diff in
8ksec: Patch Diffing CVE-2024-23265.
The fix adds a check for the sentinel -1 in FUN_fffffff028a156c8.
Get the binaries
$ ipsw download ipsw --device iPhone15,4 --build 21D61 --kernel --output 17.3.1
$ ipsw download ipsw --device iPhone15,4 --build 21E219 --kernel --output 17.4
$ ipsw kernel extract 17.3.1/*/kernelcache.release.iPhone15,4 com.apple.driver.AppleDiskImages2 --output 17.3.1
$ ipsw kernel extract 17.4/*/kernelcache.release.iPhone15,4 com.apple.driver.AppleDiskImages2 --output 17.4
Compare
$ hereticus --format markdown 17.3.1/com.apple.driver.AppleDiskImages2 17.4/com.apple.driver.AppleDiskImages2
| FUNCTION | CHANGE | SCORE | +/-/~ | TOUCHED | MATCHED BY |
|---|---|---|---|---|---|
sub_fffffff028a156c8 -> sub_fffffff008a3341c | changed | 0.97 | 4/0/0 | 1 branch | similar |
sub_fffffff028a14798 -> sub_fffffff008a324f4 | changed | 0.97 | 0/2/1 | 1 mem, 2 const | similar |
sub_fffffff028a0e780 -> sub_fffffff008a2c4e0 | changed | 0.98 | 0/0/1 | 1 const | similar |
sub_fffffff028a12400 -> sub_fffffff008a30160 | changed | 1.00 | 0/1/0 | 2 const, 5 text | similar |
sub_fffffff028a0ba10 -> sub_fffffff008a29770 | changed values | 1.00 | - | 8 const, 1 text | identical shape |
| … |
251 matched (178 unchanged, 73 changed), 0 gone, 0 new
40 changed only a constant, hidden. Use –show-retouched to list them.
The first row is the function from the report. It adds the most instructions, and it is the only function that gets new branches.
Read the fix
$ hereticus --diff sub_fffffff028a156c8 17.3.1/com.apple.driver.AppleDiskImages2 17.4/com.apple.driver.AppleDiskImages2
...
- cbnz x8, $+0x1c
+ cbz x8, $+0xc
+ cmn x8, #0x1
+ b.ne $+0x24
...
+ cmn x8, #0x1
+ csel x8, xzr, x8, eq
if (x != 0) became if (x != 0 && x != -1), as the report says.