Security researchers have released a sophisticated new kernel exploit targeting Apple iOS devices, dubbed Trigon, which leverages a critical vulnerability in the XNU kernel’s virtual memory subsystem. Discovered in the wild during Operation Triangulation, this flaw allows attackers to create a malicious memory entry spanning 18,000 petabytes—far exceeding physical device limits—by exploiting an unchecked addition of user-controlled size and offset parameters. The exploit, linked to the ith “Operation Triangulation” spyware campaign that first weaponized the flaw uncovered by Kaspersky, provides attackers with arbitrary kernel read/write primitives without triggering kernel panics—a rare feat in modern iOS exploitation. Cyber Security News is a Dedicated News Platform For Cyber News, Cyber Attack News, Hacking News & Vulnerability Analysis. To bypass Page Validation Hash (PVH) protections, Trigon sprays thousands of IOSurface objects into physical memory. By crafting an IOSurface object with the IOSurfaceMemoryRegion property set to PurpleGfxMem, attackers bypass XNU’s vm_page_insert_internal panic checks, as PurpleGfxMem entries lack the internal flag enforced for standard allocations. Have you ever wondered why businesses still face cyber threats, even with the latest security software? Cybercriminals are always finding new ways to attack. The exploit’s deterministic nature—achieving success without memory corruption or race conditions—poses a unique challenge to Apple’s security model. The exploit identifies non-page-table regions housing sprayed objects by scanning the pv_head_table—a kernel structure tracking page types. Gurubaran is a co-founder of Cyber Security News and GBHackers On Security. The Kaspersky team, who first documented CVE-2023-32434 during Operation Triangulation, plans a detailed analysis of the arm64e-compatible chain used in the wild. Researchers emphasize that KTRR/CTRR, once considered unassailable, now requires deeper integration with SoC-level MMU policies to block physical mapping exploits.
This Cyber News was published on cybersecuritynews.com. Publication date: Mon, 03 Mar 2025 08:30:32 +0000