Apple patches zero-day vulnerability in iOS, iPadOS, macOS under active attack Apple on Monday patched a zero-day vulnerability in its iOS, iPadOS, and macOS operating systems, only a week after issuing a set of OS updates addressing about three dozen other flaws. The bug, CVE-2021-30807, was found in the iGiant's IOMobileFrameBuffer code, a kernel extension for managing the screen frame buffer that …
I remember actively exploiting a flaw in the abacuses at infant school many decades ago. If you ‘shook’ them, the memory would become corrupted. If you were really determined you might force a ‘frame error’, and they’d dump their memories entirely. All over the floor. Mrs Robinson was not happy.
Did you look for variants? I've heard "like a three-legged dog".
Google nGram viewer suggests my variant is much more common since about 1890.
To be precise, one researcher discovered it four months ago and was planning to report it (but hadn't gotten to it yet). Another researcher did report it. (It's safe to assume they weren't the only two to find it.)
This is fairly common in the industry, because researchers often run across a lot of PSVs (Potential Security Vulnerabilities) and make note of them to investigate whether they're exploitable. Many PSVs aren't – for example, most null dereferences, unless you can chain them to an exception-handling (or similar) vulnerability, or unless you're interested in a DoS. So it's not uncommon to have a backlog of "oh, here's misbehavior that might be a vulnerability" items on your list.
And many vendors will ignore reports that don't have a convincing PoC, so there's little incentive to simply report a crash or the like.
The Register 
Biting the hand that feeds IT
Copyright. All rights reserved © 1998–2024
