A recently disclosed iPhone BootROM vulnerability, dubbed “usbliter8,” highlights a significant flaw in Apple’s SecureROM implementation. This vulnerability allows attackers to compromise the entire trust chain of the Application Processor (AP) on affected devices.
Research published by Paradigm Shift on June 18, 2026, showcases a working exploit that targets Apple A12 and A13 system-on-chips (SoCs).
The exploit exploits a flaw in the USB controller’s Direct Memory Access (DMA) handling, combined with certain firmware misconfigurations. Since BootROM is immutable, this vulnerability cannot be patched through software updates, leaving affected devices permanently exposed.
iPhone BootROM Vulnerability
At the core of the issue is the Synopsys DesignWare USB2 (DWC2) controller used in Apple silicon. The vulnerability arises during USB control transfers, specifically in the handling of Setup packets.
According to the USB specification, each Setup transaction must contain exactly 8 bytes. However, the controller accepts malformed or smaller packets and writes them into memory in 4-byte chunks.
The DMA engine increments its pointer based on the actual data written. However, it resets it to the beginning of the fixed-size packet, introducing a mismatch. This results in a controlled buffer underflow primitive in 12-byte steps, effectively allowing attackers to overwrite adjacent memory regions.
The flaw becomes exploitable because Apple configured the DMA address register (DOEPDMA). Instead of acting as a static buffer pointer, it behaves as a dynamic source of truth, incrementing after each write.
On A12 and A13 devices, the absence of proper DART (Device Address Resolution Table) protections in SecureROM further enables unrestricted memory writes, including sensitive SRAM regions. Earlier chips like A11 mitigate this via manual DMA resets, while newer generations (A14 and later) configure DART correctly, preventing exploitation.
Achieving program counter (PC) control differs across chipsets. On A12, attackers can overwrite the saved link register (LR) on the USB task stack due to a favorable memory layout, enabling straightforward control-flow hijacking.
A13 introduces Pointer Authentication (PAC), complicating direct exploitation. Researchers bypassed this by chaining multiple primitives, including heap corruption, controlled zero writes, and manipulation of critical system structures. One notable primitive is derived from the DART cleanup routine:
void dart_stop(unsigned int dart_id)
{
dart = darts[dart_id];
mmio_base = dart->info->mmio_base;
for (int i = 0; i < 16; i += 4) {
*(_DWORD *)(mmio_base + 0x200 + i) = 0;
}
}This primitive enables controlled zeroing of memory, which is later used to neutralize heap protections and manipulate execution flow. By carefully timing DMA writes and exploiting task scheduling behavior, attackers avoid corrupting critical registers while still achieving arbitrary memory overwrite.
Once PC control is obtained, the exploit pivots to SecureROM privilege escalation. Although SecureROM primarily operates in EL0, specific instructions, such as “SVC 0,” allow temporary transitions to EL1.
The exploit targets a boot trampoline function, injecting shellcode into executable memory via DMA and bypassing signature checks. On A12, this is achieved using a minimal ROP chain, while A13 requires more advanced techniques due to PAC enforcement.
Post-exploitation capabilities are significant. The attacker can modify the boot process, inject custom USB handlers, and enable the execution of unsigned iBoot. The exploit also introduces custom DFU commands, including “demotion” (lowering device security state) and arbitrary booting of firmware images.
Although it does not directly compromise the Secure Enclave Processor (SEP), the attack weakens system-wide trust boundaries and may facilitate further attacks.
Importantly, the vulnerability highlights a broader class of hardware-level flaws that persist across device lifecycles. Since BootROM cannot be updated, the only mitigation is hardware replacement.
Paradigm Shift confirmed coordinated disclosure with Apple, and while newer devices are not affected, millions of A12 and A13-based devices remain vulnerable.
The usbliter8 research underscores a critical reality in modern mobile security: even advanced mitigations like PAC and secure boot chains can be undermined by subtle hardware design flaws.
Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.
