5,579
edits
Changes
Jump to navigation
Jump to search
m
→IOS: sorted by IOS module
Line 86:
Line 86:
|-
−| STM
−| STM release bug
−| The state transition manager checks if a handle is invalid before releasing it, but forgets to actually refuse to release it if it is invalid. More information can be seen at [[STM Release Exploit]]
−| Control over IOS can be gained.
−| [[4.0]]
−| {{SortableMonth}}
−| [[fail0verflow]], Anonymous person (from reverse engineering [[Homebrew Channel]] installer)
| [[fail0verflow]]
−|-
−| Kernel
−| No sanity checks on arguments passed to get_kernel_flavor and get_unk_flavor
−| System calls get_kernel_flavor and get_unk_flavor do not check to ensure that the pointers passed are appropriate to write to; they will write to any addresses.
−| If IOS code execution is gained, any address can be overwritten to some specific values by passing those addresses into get_kernel_flavor or get_unk_flavor.
−| Unknown
−| {{SortableMonth}}
! Discovered
! Discovered
! Discovered by
! Discovered by
+|-
+| Kernel
+| No sanity checks on arguments passed to get_kernel_flavor and get_unk_flavor
+| System calls get_kernel_flavor and get_unk_flavor do not check to ensure that the pointers passed are appropriate to write to; they will write to any addresses.
+| If IOS code execution is gained, any address can be overwritten to some specific values by passing those addresses into get_kernel_flavor or get_unk_flavor.
+| Unknown
+| {{SortableMonth}}
+| [[fail0verflow]]
|-
|-
| ES
| ES
Line 94:
Line 102:
| {{SortableMonth}}
| {{SortableMonth}}
| [[fail0verflow]] and xt5 (independently)
| [[fail0verflow]] and xt5 (independently)
−|-
|-
| ES
| ES
Line 109:
Line 109:
| Unfixed
| Unfixed
| {{SortableMonth|Jun|2008}}
| {{SortableMonth|Jun|2008}}
−| [[fail0verflow]]
| [[fail0verflow]]
|-
|-
Line 158:
Line 150:
| Unknown
| Unknown
| {{SortableMonth}}
| {{SortableMonth}}
+|-
+| STM
+| STM release bug
+| The state transition manager checks if a handle is invalid before releasing it, but forgets to actually refuse to release it if it is invalid. More information can be seen at [[STM Release Exploit]]
+| Control over IOS can be gained.
+| [[4.0]]
+| {{SortableMonth}}
+| [[fail0verflow]], Anonymous person (from reverse engineering [[Homebrew Channel]] installer)
|}
|}