The Patching Friars' AlmanacA calendar of CVE saints

December 28

dmaFailHoly card for dmafail, generated with AI (Claude, Anthropic) for the Lunario dei Frati Patchatori.CC BY-NC-SA 4.0 MMIO 0x??? dmaFail SCRIBIT UBI NON LICET
🤖 Image and text generated with AI

⬇ Download holy card: ·

Embed on your site

Saint dmaFail, Who Wrote Where He Shouldn't

Patron of forgotten MMIO registers, Apple chips, and researchers who study one attack and find another inside it.

Life

On 28 December 2023, within the same work on Operation Triangulation, dmaFail emerged, that is CVE-2023-38606: certain undocumented hardware registers of Apple chips let an app write into kernel memory regions that should have been protected. It was the piece holding up the whole iPhone chain, a mishandled state flaw in a bit of silicon no one should have been able to touch.

Prayer

O Saint dmaFail, who writes in the corners of memory no one was watching, let every hardware register have a guardian. Amen.

How to celebrate

Celebrated by updating Apple devices to the fixed versions and respecting the silicon you can't see.

A forgotten register, a wide-open kernel.

Technical record

Disclosed on
December 28 2023
CVE
CVE-2023-38606
CVSS
5.5Actively exploited (CISA KEV)
Product
Apple · tvOS

This issue was addressed with improved state management. This issue is fixed in macOS Monterey 12.6.8, iOS 15.7.8 and iPadOS 15.7.8, iOS 16.6 and iPadOS 16.6, tvOS 16.6, macOS Big Sur 11.7.9, macOS Ventura 13.5, watchOS 9.6. An app may be able to modify sensitive kernel state. Apple is aware of a report that this issue may have been actively exploited against versions of iOS released before iOS 15.7.1.

Sources: media.ccc.de · theapplewiki.com

Also remembered today

Shortcuts: ← → to move, D day, W week, M month, T today.

📅 Add to your calendar

SaintsGoogle CalendarApple, Outlook (.ics)

Observances (feasts, scourges and miracles)Google CalendarApple, Outlook (.ics)

In Google Calendar you can also paste the URL in Settings → Add calendar → From URL. The first sync can take a few hours.