Technical Analysis of the Pegasus Exploits on iOS

<strong>Analysis</strong> <strong>of</strong> <strong>the</strong> <strong>Pegasus</strong> Safari Exploit
The first stage <strong>of</strong> <strong>Pegasus</strong> exploits a vulnerability in WebKit’s JavaScriptCore library (CVE-
2016-4657). The exploit uses <strong>the</strong> Safari web browser to run a JavaScript payload that exploits
<strong>the</strong> initial vulnerability to gain arbitrary code execution in <strong>the</strong> context <strong>of</strong> <strong>the</strong> Safari WebContent
process.
Background
The vulnerability exists within <strong>the</strong> slowAppend() method <strong>of</strong> MarkedArgumentBuffer and can be
exploited via <strong>the</strong> usage <strong>of</strong> a MarkedArgumentBuffer in <strong>the</strong> static defineProperties() method. The
defineProperties() method accepts as input an object whose own enumerable properties
constitute descriptors for <strong>the</strong> properties to be defined or modified on ano<strong>the</strong>r target object. The
algorithm used to associate each <strong>of</strong> <strong>the</strong>se properties with <strong>the</strong> target object does two iterations <strong>of</strong>
<strong>the</strong> provided list <strong>of</strong> properties. In <strong>the</strong> first pass, each <strong>of</strong> <strong>the</strong> property descriptors is checked for
proper formatting and a PropertyDescriptor object is created that references <strong>the</strong> underlying
value.
size_t numProperties = propertyNames.size();
Vector descriptors;
MarkedArgumentBuffer markBuffer;
for (size_t i = 0; i < numProperties; i++) {
JSValue prop = properties->get(exec, propertyNames[i]);
if (exec->hadException())
return jsNull();
PropertyDescriptor descriptor;
if (!toPropertyDescriptor(exec, prop, descriptor))
return jsNull();
descriptors.append(descriptor);
The second pass is performed after each property has been validated. This pass associates
each <strong>of</strong> <strong>the</strong> user-supplied properties with <strong>the</strong> target object, using <strong>the</strong> type specific
defineOwnProperty() method.
for (size_t i = 0; i < numProperties; i++) {
Identifier propertyName = propertyNames[i];
if (exec->propertyNames().isPrivateName(propertyName))
continue;
object->methodTable(exec->vm())->defineOwnProperty(object, exec, propertyName,
descriptors[i], true);
This method may result in user-defined JavaScript methods (that are associated with <strong>the</strong>
property being defined) being called. Within any <strong>of</strong> <strong>the</strong>se user-defined methods, it is possible
that a garbage collection cycle may be triggered, resulting in any unmarked heap backed
objects being free()ed. Therefore, it is important that each <strong>of</strong> <strong>the</strong> temporary references to <strong>the</strong>se
Page 3