A12 and A13: These iPhones remain vulnerable Apfelpatient

A new security vulnerability affects Apple's A12 and A13 chip generations – and it is essentially unfixable. Because the flaw is deeply embedded in the processors' boot code, devices from the iPhone XS to the iPhone 11 series remain permanently vulnerable. The exploit, named usbliter8, is based on a hardware bug that no software update can fix.

Security vulnerabilities are a part of everyday life for any operating system – Apple usually closes them with the next update. That's not possible here. The security research firm Paradigm Shift has publicly disclosed a vulnerability in the so-called BootROM of the A12 and A13 chips, including a working proof-of-concept exploit called usbliter8. While Apple regularly addresses common vulnerabilities with patches, as recently seen with the belatedly released CVE details for several security updates, this vulnerability will remain – for the entire lifespan of the affected devices.

Why the gap cannot be closed

The BootROM, also known as SecureROM, is the first code an iPhone executes when powered on. It is permanently burned into the chip during manufacturing and cannot be altered afterward. Therefore, a vulnerability at this point cannot be fixed with an iOS update – affected devices remain permanently vulnerable.

The last publicly known BootROM exploit of this type was checkm8 from 2019, which affected devices from the iPhone 4S to the iPhone X. usbliter8 now continues this series with the next chip generation and covers models from the iPhone XS to the iPhone 11 series.

Which devices are affected

Only the two chip generations A12 and A13 are vulnerable. The older A11 generation is not affected because its USB driver manually resets a crucial memory pointer after each data packet. The A14 and all newer chips are also safe, as they correctly configure a memory protection function at the boot ROM level. The A12 and A13 occupy the vulnerable gap.

Chip	Devices (selection)	Status
A11	iPhone 8, iPhone X	not affected
A12	iPhone XS, iPhone XS Max, iPhone XR	affected
A13	iPhone 11, iPhone 11 Pro, iPhone 11 Pro Max, iPhone SE (2nd generation)	affected
A14 and newer	iPhone 12 and all later models	not affected

This is how usbliter8 works

The exploit takes advantage of a flaw in the chips' USB controller. When an iPhone receives USB data during the startup process, the controller stores the incoming packets in a memory buffer. The researchers discovered that a specific sequence of unusually small packets can manipulate an internal hardware pointer, causing it to move backward through memory. This allows data to be written to locations it should never reach. The researchers believe the flaw lies in the USB controller hardware itself, not in Apple's software.

How easily a complete takeover can be achieved depends on the specific chip. Code execution is relatively straightforward on A12 devices. It becomes significantly more difficult with the A13, as Apple introduced Pointer Authentication Codes (PAC) with this generation. These codes detect and block certain forms of memory manipulation. According to Paradigm Shift, circumventing this protection required a lengthy, multi-stage process before the researchers were finally able to gain control of the processor.

What a successful attack makes possible

Once the exploit gains control, it installs its own handler that even survives a device restart. This allows two things to be achieved: The iPhone's security settings can be temporarily lowered, and unsigned software can be launched without any verification. As a distinguishing mark, the exploit also writes the traditional "PWND" inscription into the device's USB serial number – a convention already known from checkm8 and previous attacks.

usbliter8 does not directly attack the Secure Enclave, which contains particularly sensitive data such as biometric information. However, the researchers point out that a BootROM compromise of this kind could open up further attack vectors to the Secure Enclave.

How serious the gap really is

The key to classifying this attack is its prerequisite: it requires physical access to the device and a USB connection during the boot process. usbliter8 cannot be triggered remotely, for example via a website or message. For everyday use of an affected iPhone, this means a limited risk, as long as the device does not fall into the wrong hands.

The vulnerability becomes more relevant in scenarios involving physical access – for example, with confiscated, lost, or resold devices. Paradigm Shift states that it reported its findings to Apple Product Security before publication and collaborated with the company as part of a coordinated disclosure. The complete proof-of-concept code was published along with the technical analysis. Anyone selling an older iPhone with an A12 or A13 chip should therefore prepare it particularly thoroughly – our guide on how to securely reset an iPhone before selling it summarizes what's important.

Hardware vulnerabilities don't disappear with age

Unlike software vulnerabilities, usbliter8 doesn't disappear with the next update. As long as devices with A12 and A13 chips are in circulation, the vulnerability remains open – and more of these models appear on the used market every year. However, there is no risk for current iPhones with the A14 chip or later, as Apple closed the underlying security gap starting with this generation. (Image: Shutterstock / Adel Newman)