Light

Episode #955 Quiz

The Mystery of CVE-2023-38606
Date: 2024-01-02 | Length: 1.75 hrs | Episode page at twit.tv

About this episode

Kaspersky traced Operation Triangulation’s zero-click iMessage chain: font RCE, JavaScriptCore privilege escalation, kernel memory read/write, then CVE-2023-38606 disabling Apple’s Page Protection Layer. Apple’s A12-A16 chips exposed undocumented GPU MMIO registers gated by a secret 20-bit hash, allowing signed DMA writes until iOS 16.6 unmapped those ranges.

Your name and email are stored only in your browser local storage for convenience. They are not retained server-side.

NameEmail

Question 1: According to the episode, what specific mechanism did the attackers use to authenticate writes through the hidden Apple hardware feature before the PPL bypass was applied?

Question 1

According to the episode, what specific mechanism did the attackers use to authenticate writes through the hidden Apple hardware feature before the PPL bypass was applied?

An HMAC keyed by the device’s unique CPU identifier A per-device RSA signature embedded in the firmware image A standard SHA-256 signature over the target DMA payload A custom 20-bit hash over a predefined SBox table

Question 2: What did Apple’s mitigation for CVE-2023-38606 do during boot, according to the episode?

Question 2

What did Apple’s mitigation for CVE-2023-38606 do during boot, according to the episode?

It forces the kernel to reject every DMA request system-wide It unmaps the required memory ranges before later code can use them It disables all GPU functionality until the device is restored It rewrites the device tree to remove all MMIO entries

Question 3: Which Apple chip families were said to include the hidden feature discussed in the episode?

Question 3

Which Apple chip families were said to include the hidden feature discussed in the episode?

A10 through A14 Bionic A13 through A17 Bionic A11 through A15 Bionic A12 through A16 Bionic

Question 4: How did the episode say Kaspersky determined the unknown MMIO blocks were associated with the GPU coprocessor?

Question 4

How did the episode say Kaspersky determined the unknown MMIO blocks were associated with the GPU coprocessor?

They observed the CPU family code directly naming the GPU registers They saw the ranges surround the GPU area and confirmed it by provoking a GPU panic They found the same registers documented in the firmware source code They matched the registers to a hidden Apple diagnostic app on the device

Question 5: What was Steve Gibson’s main objection to Kaspersky’s description of the vulnerability as 'security through obscurity'?

Question 5

What was Steve Gibson’s main objection to Kaspersky’s description of the vulnerability as 'security through obscurity'?

He argued the feature required prior secret knowledge, not mere discovery He argued that the feature could be brute-forced if enough time were available He argued the feature was only secure because the SBox table was too large He argued that the feature was harmless because it had no effect on PPL

Cancel

My Data//Security & Privacy//Clear Local Data

© 2026 Ken ArmstrongSecurity Now™ is a trademark of TWiT LLC. All trademarks and copyrights of the Security Now podcast are respected and reserved to their respective holders.
This is a hobby project made with love and admiration for what Steve Gibson and Leo Laporte have built over 20 years.