A new BootROM vulnerability, dubbed usbliter8, affects Apple devices powered by A12, S4/S5, and A13 SoCs.
The exploit chains a hardware-level bug in the Synopsys DWC2 USB controller with a firmware configuration flaw to achieve full application processor boot-chain compromise, and because it resides in immutable ROM code, there is no software patch possible for affected hardware.
The vulnerability originates in how the DWC2 USB controller manages DMA (Direct Memory Access) for incoming USB Setup packets. The controller stores up to three consecutive Setup packets in memory using a ring-buffer mechanism.
When a fourth Setup transaction is received, it decrements the DOEPDMA register by a fixed 24 bytes to reset the write pointer.
New iPhone BootROM Flaw
The critical flaw: the controller also accepts smaller packets stored in 4-byte chunks, meaning the pointer increment does not always equal the fixed 24-byte decrement.
This mismatch creates a buffer-underflow primitive in 12-byte increments, allowing an attacker with physical USB access to overwrite arbitrary SRAM data.
On A12 and A13, the USB DART (Device Address Resolution Table) is configured in bypass mode in SecureROM, which provides no memory-isolation barrier to prevent these out-of-bounds writes.
Researchers confirmed that A11 is not vulnerable because its USB driver manually resets the DMA address after each packet. A14 and later generations correctly configure DART in SecureROM, rendering the bug unexploitable on newer silicon.
On A12 and S4/S5, exploitation is relatively straightforward. The DMA buffer sits adjacent to the USB task’s stack on the heap, so the underflow directly overwrites a saved link register (LR).
A compact ROP chain then reprograms the DMA destination address to target the boot trampoline a region not writable from EL0 or EL1 but fully reachable via DMA and injects attacker-controlled shellcode before redirecting execution to gain EL1 privileges.
On A13, Pointer Authentication (PAC) complicates direct LR corruption. The researchers employed a multi-step technique involving controlled overwrites of DART heap structures, a 16-byte zero-write primitive, and a 0xF write targeting a global panic depth counter.
This forces panics into infinite loops rather than reboots. By carefully timing DMA writes relative to the USB task’s execution state, they preserved the task context long enough to overwrite the USB IRQ handler entry in BSS, achieving a fully controlled program counter (PC) with controlled arguments.
Following PC control, the exploit elevates execution from EL0 to EL1 by redirecting code flow to an existing SVC 0 transition within the ROM’s iBoot jump function.
On A13, due to the complexity of cleanup from near-total SRAM corruption, the team restarts SecureROM entirely, copying a patched ROM image to the top of SRAM and remapping it via the MMU to the original ROM virtual address space to ensure correct PC-relative memory accesses.
The resulting post-exploitation capabilities are significant. SoC demotion temporarily lowers production mode to unlock debugging features, while unsigned iBoot booting allows loading arbitrary iBoot images without signature verification.
A custom USB request handler is injected persistently throughout the DFU session, and the PWND string is appended to the USB serial number as a standard exploitation marker to ensure toolchain compatibility.
Because usbliter8 exploits a hardware defect in immutable BootROM code, no firmware update can remediate it.
Affected A12 and A13 devices spanning the iPhone XS/XR through iPhone 11 series and related Apple Watch and iPad models will remain permanently vulnerable for the remainder of their operational lifetime.
While Apple’s Secure Enclave Processor (SEP) provides an additional security boundary protecting user data, the researchers note that usbliter8 opens broader attack vectors that could be used to target the Secure Enclave indirectly.
The research was coordinated with Apple Product Security prior to public disclosure, with the team acknowledging Apple’s prompt and constructive engagement throughout the process.
Follow us on Google News , LinkedIn and X to Get More Instant Updates. Set Cyberpress as a Preferred Source in Google.
