Critical iPhone BootROM Bug Exposes Apple SoCs to Full Compromise

Key Takeaways

• A critical, unpatchable BootROM vulnerability, dubbed “usbliter8,” has been discovered in several Apple SoCs.
• The flaw impacts devices featuring Apple’s A12, S4/S5, and A13 chips, including iPhone XS, XR, iPhone 11 series, and certain Apple Watch models.
• The hardware-level bug allows for a full compromise of the application processor’s boot chain, bypassing Apple’s Secure Boot.
• Due to its immutable nature, no software update can fix this vulnerability; hardware migration to A14 or newer is the only full mitigation.

A severe hardware-level vulnerability, identified as “usbliter8,” has been uncovered in specific Apple System-on-Chips (SoCs), potentially exposing a range of iPhones and Apple Watches to complete boot-chain compromise. This exploit leverages a fundamental flaw within the Synopsys DWC2 USB controller, combined with a firmware configuration oversight, to gain deep access to affected devices. Crucially, because the BootROM code is permanently etched into silicon, this vulnerability cannot be patched through software updates.

Researchers at Paradigm Shift, who discovered the vulnerability, pinpointed its origin in the DWC2 USB controller’s method for processing consecutive USB Setup packets. The controller is designed to buffer up to three Setup packets in memory. Following this, it resets the Direct Memory Access (DMA) base address, stored in the DOEPDMA register, to its initial position, effectively operating as a ring buffer.

The core of the flaw lies in the pointer arithmetic involved. While the controller increments DOEPDMA by the exact size of the data written after each operation, the reset mechanism consistently decrements it by a fixed 24 bytes. This mismatch becomes critical because the controller also accepts smaller, 4-byte packet chunks. The discrepancy between the variable increment and the constant decrement leads to a buffer underflow primitive, advancing in 12-byte steps. This allows attackers to write data to memory regions outside the intended buffer boundaries in a controlled manner.

For A12 and A13 SoCs, the USB Device Address Resolution Table (DART) is configured in bypass mode within SecureROM. This means there is no Input/Output Memory Management Unit (IOMMU) barrier in place to prevent DMA from overwriting arbitrary data in SRAM. Newer generations, specifically A14 and subsequent chips, correctly configure DART, rendering them immune to this particular exploitation method.

Exploitation Differences: A12 vs. A13

Exploiting the usbliter8 vulnerability varies slightly between the A12 and A13 generations due to architectural differences.

Exploiting A12 and S4/S5

On A12 and S4/S5 chips, the exploitation process is relatively straightforward. The DMA buffer resides directly adjacent to the USB task’s stack on the heap. Attackers can corrupt a saved Link Register (LR), enabling them to seize Program Counter (PC) control during a scheduler context switch. A concise Return-Oriented Programming (ROP) chain is then used to redirect DMA writes into the boot trampoline, a memory area typically non-writable from EL0 (the lowest privilege level). The attack then transitions into SecureROM’s EL1 (kernel privilege) routine, executing attacker-supplied shellcode with full system privileges.

Exploiting A13

The A13 chip introduces Pointer Authentication Codes (PAC), which significantly complicates direct LR corruption. To circumvent this, researchers devised a sophisticated, multi-stage technique. This involved carefully controlled overwrites of DART heap metadata, effectively neutralizing heap checksum protections. Furthermore, they suppressed system reboots on kernel panics by overwriting a global panic counter using a 0xF write primitive. Ultimately, execution is rerouted through a specific gadget that loads a function pointer from memory controlled by the attacker. This bypasses PAC because only the Instruction Branch (IB) key is enabled in the firmware, an oversight that proved critical for the exploit.

Once EL1 code execution is achieved, the exploit injects a custom USB request handler into unused boot trampoline space. It then modifies the USB serial number to include a “PWND” identifier and restores corrupted heap allocations to maintain device stability. On A13, the extensive memory corruption necessitates a full SecureROM restart. Researchers achieved this by copying the ROM into SRAM, remapping it via custom Memory Management Unit (MMU) translation tables, and hooking ROM Page Table Entry (PTE) generation to ensure address space consistency throughout the restart process.

The custom handler enables two highly privileged operations: SoC demotion (temporarily reducing the device’s production mode status) and unsigned iBoot booting. The latter allows the system to boot raw iBoot images without any signature verification, effectively nullifying Apple’s entire Secure Boot chain.

Affected Devices and Mitigations

The following Apple SoCs have been confirmed as vulnerable to the usbliter8 exploit:

• Apple A12 (found in iPhone XS, iPhone XR, and iPad Pro 2018 models)
• Apple S4/S5 (found in Apple Watch Series 4 and Series 5)
• Apple A13 (found in the iPhone 11 series)

Given that BootROM vulnerabilities reside in immutable hardware, no software or firmware update can remediate this issue. The only truly effective mitigation is to migrate to devices equipped with A14 or newer hardware. While Apple’s Secure Enclave Processor (SEP) provides an additional layer of security, researchers note that usbliter8 opens broader avenues for indirectly attacking the Secure Enclave.

Paradigm Shift coordinated disclosure of this vulnerability with Apple Product Security prior to public release. The full proof-of-concept exploit is available in their research repository.

What You Should Do

• Upgrade Hardware: For devices with A12, S4/S5, or A13 chips, consider upgrading to devices powered by A14 or newer Apple SoCs, as these are not susceptible to usbliter8.
• Maintain Physical Security: Since this vulnerability typically requires physical access or a specialized USB connection, ensure strict physical security for affected devices.
• Be Vigilant for Exploitation: While the exploit requires specific conditions, be aware that advanced attackers could leverage this for persistent access or to bypass secure boot mechanisms.
• Stay Informed: Continue to monitor official Apple security advisories and reputable cybersecurity news sources for any further developments related to hardware vulnerabilities.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.