cve-2021-30807-analysis

name

cve-2021-30807-analysis

description

Analyze and understand CVE-2021-30807, an iOS kernel out-of-bounds read vulnerability in IOMobileFramebuffer/AppleCLCD. Use this skill when researching iOS kernel exploits, studying IOMobileFramebuffer vulnerabilities, analyzing selector 83 exploitation, understanding IOSurface heap spraying techniques, or examining the OOB pointer read + type confusion primitive. Trigger for any questions about this specific CVE, iOS kernel user client exploitation, or when analyzing the Saar Amar PoC code.

CVE-2021-30807: IOMobileFramebuffer OOB Analysis

A skill for understanding and analyzing CVE-2021-30807, an out-of-bounds read vulnerability in iOS kernel's IOMobileFramebuffer/AppleCLCD that enables arbitrary kernel reads.

Vulnerability Overview

Affected Versions:

• iOS/iPadOS < 14.7.1
• macOS Big Sur < 11.5.1
• watchOS < 7.6.1

Vulnerability Type: Out-of-bounds pointer read + type confusion

Impact: Arbitrary kernel read primitive (can lead to LPE with additional techniques)

Entitlement Required: com.apple.private.allow-explicit-graphics-priority (available to WebKit.WebContent)

The Bug Mechanics

Vulnerable Code Path

Userland → IOMobileFramebufferUserClient::s_displayed_fb_surface(...)
         → IOMobileFramebufferLegacy::get_displayed_surface(this, task*, out_id, scalar0)
         → ptr = *(this + 0xA58 + scalar0 * 8)  // OOB READ
         → IOSurfaceRoot::copyPortNameForSurfaceInTask(task, (IOSurface*)ptr, &out)

Key Details

1. User-controlled index: scalar0 is a 32-bit value passed from userland with no bounds checking

2. OOB pointer fetch: The kernel reads from this + 0xA58 + index*8 where