New Unpatchable BootROM Exploit Targets Apple’s A12 and A13 Chips
Security research firm Paradigm Shift has published details of a new BootROM vulnerability affecting Apple’s A12 and A13 chips, alongside a working proof-of-concept exploit named “usbliter8.” The flaw resides in the USB controller hardware itself, meaning it cannot be fixed through software updates and leaves affected devices exposed for the remainder of their support life. The exploit covers devices from the iPhone XS through the iPhone 11 series.
What is the BootROM and why can’t it be patched?
The BootROM, also called SecureROM, is the first code an iPhone executes when it powers on. Because it is baked into the chip at manufacture, any vulnerability in it cannot be addressed with a software update, leaving affected devices exposed for the remainder of their support life.
Which devices are affected?
The exploit covers devices using A12 and A13 silicon, spanning the iPhone XS through the iPhone 11 series. The last publicly documented BootROM exploit of this class was “checkm8,” released in 2019, which affected devices from the iPhone 4S through the iPhone X. Usbliter8 extends that lineage to the next chip generation.
How does the exploit work?
The flaw lies in the USB controller built into these chips. When an iPhone receives USB data during startup, the controller places incoming packets into a memory buffer. Paradigm Shift discovered that by sending a specific sequence of unusually small packets, an internal hardware pointer can be manipulated so that it walks backwards through memory, allowing data to be written to locations it should not reach.
The researchers describe this as a bug in the USB controller hardware itself rather than in Apple’s software, which is why no patch is possible.
Why are A11 and A14 spared?
The A11 chip used in the iPhone X is not affected because its USB driver manually resets the pointer after each packet. A14 and later chips are also safe, as they configure a memory protection feature correctly at the BootROM level. The A12 and A13 sit between these two implementations, in a configuration the researchers describe as a vulnerable middle ground.
How does exploitation differ between A12 and A13?
Gaining code execution on A12 devices is relatively straightforward. On A13 devices, Apple had introduced Pointer Authentication Codes (PAC), a security feature that detects and blocks certain types of memory tampering. Working around PAC on the A13 required a lengthy, multi-step process before the researchers could finally take control of the processor.
What does the exploit achieve?
Once control is established, the exploit installs a custom handler that survives a device restart. This handler can temporarily lower the device’s security settings and boot unsigned software without verification checks. Following a long-running convention from checkm8 and earlier exploits, it also injects the string “PWND” into the iPhone’s USB serial number as a visible signal of compromise.
What about the Secure Enclave?
Paradigm Shift notes that usbliter8 does not affect the Secure Enclave directly. However, a BootROM compromise of this kind opens wider avenues for attacking the Secure Enclave on affected devices.
How was the vulnerability disclosed?
Paradigm Shift reported its findings to Apple Product Security before publication and worked with Apple on coordinated disclosure. The full proof-of-concept code has been published alongside the write-up at ps.tc.
FAQ
What is usbliter8?
Usbliter8 is a proof-of-concept BootROM exploit published by a security research firm. It targets an unpatchable vulnerability in the USB controller of Apple’s A12 and A13 chips.
Which iPhones are affected by the usbliter8 exploit?
Devices using A12 and A13 silicon are affected, spanning the iPhone XS through the iPhone 11 series. The iPhone X (A11) and A14 and later chips are not vulnerable.
Can Apple patch the usbliter8 vulnerability?
No. The flaw lies in the USB controller hardware itself rather than in Apple’s software, and BootROM code is baked into the chip at manufacture, so it cannot be patched through a software update.