You’ve Got 0-Click Mail: Unassisted iOS Attacks RCE via Mobilemail/Maild
A number of interesting points:<p>* This was abused in the wild in targeted attacks against individuals including corporate executives and journalists, and, based on the presence of suspicious 0x41s in the exploit, likely purchased and minimally modified.<p>* On iOS 13 the attacks are even more powerful, as moving the mail parsing out-of-process means it is “0-click” and can silently crash without alerting the user of a problem (and the process’s VM layout is much more consistent to boot). Humorously, the error message that appears (“This message has no content”) is a common bug <i>anyways</i> so users have been trained to ignore it.<p>* Memory mapping files is hard, and there’s some non-trivial error cases that need to be checked.<p>* A fix is in iOS 13.4.5 beta.<p>(By the way, MobileMail and maild from the title are process names and are spelled as such.)