<story><title>How to unc0ver a 0-day in 4 hours or less</title><url>https://googleprojectzero.blogspot.com/2020/07/how-to-unc0ver-0-day-in-4-hours-or-less.html</url></story><parent_chain></parent_chain><comment><author>akersten</author><text>&amp;gt; So, to summarize: the LightSpeed bug was fixed in iOS 12 with a patch that didn&amp;#x27;t address the root cause and instead just turned the race condition double-free into a memory leak. Then, in iOS 13, this memory leak was identified as a bug and &amp;quot;fixed&amp;quot; by reintroducing the original bug, again without addressing the root cause of the issue. And this security regression could have been found trivially by running the original POC from the blog post.&lt;p&gt;Yikes. Especially looking at the diff of the original problematic fix, it seems like they slapped a quick patch on there and called it a day, instead of investigating to find the underlying architectural issue. Doesn&amp;#x27;t really inspire a lot of confidence that the resolution for unc0ver is any more thought-through. I wonder if they&amp;#x27;ve identified the root-cause? That&amp;#x27;d be the real interesting piece to me.</text></comment>
<story><title>How to unc0ver a 0-day in 4 hours or less</title><url>https://googleprojectzero.blogspot.com/2020/07/how-to-unc0ver-0-day-in-4-hours-or-less.html</url></story><parent_chain></parent_chain><comment><author>devenblake</author><text>&amp;gt; By 1 AM, I had sent Apple a POC and my analysis.&lt;p&gt;&amp;gt; Still, I&amp;#x27;m very happy that Apple patched this issue in a timely manner once the exploit became public.&lt;p&gt;Sh- should we be happy Apple fixed this so quickly? unc0ver allows consumers to get more out of their Apple devices, and Apple&amp;#x27;s fix isn&amp;#x27;t really optional (unless you disable auto-updates and tap &amp;quot;Later&amp;quot; on every update notification). Is this exploit even an issue? Apple&amp;#x27;s probably not going to let an app exploiting this zeroday into its App Store and sideloading is difficult; it&amp;#x27;s very unlikely someone malicious is going to trick people into installing malware that uses this exploit. It sounds to me like Apple is purposefully limiting consumer freedom by actively trying to prevent jailbreaking.</text></comment>