R3n3r0/CVE-2026-20700

GitHubRepository PoCExploit

PoC files

11 files

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

GitHub
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

The artifact is a proof-of-concept exploit for CVE-2026-20700 that demonstrates using dyld's chained fixup mechanism as a PAC signing oracle on arm64e iOS. It includes a hand-crafted Mach-O dylib generator, a launcher that loads it to trigger dyld to write PAC-valid function pointers into attacker-chosen slots, and a dispatch event loop demonstration that calls the written pointer without direct invocation.

Backdoor review

No backdoor observed in reviewed code

The repository is a proof-of-concept for CVE-2026-20700, demonstrating dyld chained fixup manipulation to produce PAC-valid pointers. All code serves this research purpose: generating a malformed Mach-O dylib, loading it, and verifying that dyld writes a controlled pointer. No concealed executable behavior, credential theft, persistence, or unrelated payloads were found. The dispatch timer demo is a natural extension of the PoC to show the pointer is callable through the event loop, not a backdoor.

ClassificationExploit
Model confidence95%
AuthenticationNot required
LanguagesCPython
Target softwareApple dyldiOS
Attack typesmemory corruptionarbitrary code executionPAC bypass
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The artifact contains code that actively exercises a vulnerability to achieve a controlled write of a PAC-valid pointer and then executes that pointer, which constitutes exploitation. The README explicitly states it demonstrates a 'write-what-where' primitive and 'dispatch event loop execution' of the written pointer.

README.md:13-15src/launcher.c:189-194

Requirements

  • Ability to load a hand-crafted Mach-O dylib on the target iOS device (e.g., via sideloading or developer certificate).README.md:59
  • Target device must be arm64e (e.g., iPhone 14) running a vulnerable iOS version (< 26.3).README.md:7

Observed behavior

  • Generates a malformed Mach-O dylib with a crafted chained fixup chain that instructs dyld to write a PAC-valid function pointer into a controlled location in the dylib's __DATA segment.generators/gen_malformed_dylib.py:311-316
  • The launcher loads the malformed dylib, causing dyld to process the fixup chain and overwrite a canary-protected slot with the address of a known exported function.src/launcher.c:108-116
  • The launcher reads the overwritten slot, validates canaries, and directly calls the function pointer written by dyld, confirming the write-what-where primitive.src/launcher.c:189-194
  • In 'chain_close' mode, the launcher registers the dyld-written pointer as a dispatch_source timer handler, causing the event loop to call it naturally without direct invocation from the PoC code.src/launcher.c:344-372
  • A second thread with a small stack triggers a dyld page-in linking gate stress test by loading a dylib with ~99k imported symbols, aiming for a deterministic crash.src/launcher.c:275-308
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Poc Behavior
Generates and loads a hand-crafted Mach-O dylib to trigger dyld chained fixup writes into its own __DATA sectionCore demonstration of CVE-2026-20700: dyld as a PAC signing oraclegenerators/gen_malformed_dylib.py:1-935src/launcher.c:80-241
Poc Behavior
Uses dispatch_source timer to call a dyld-written function pointer through the event loopDemonstrates that the PAC-valid pointer is callable without direct invocation, part of the 'chain close' conceptsrc/launcher.c:339-377
Poc Behavior
Stresses dyld page-in linking gate with ~99k symbol imports on a small stack threadExplores the vulnerability's reachability and crash conditionsgenerators/gen_client.py:1-112src/launcher.c:246-308
Review boundaries

What the analysis did not establish

  • The evidence does not include the generated binary dylibs or the compiled PoCApp.ipa; only source code and build scripts are provided.
  • The artifact's own documentation states the write primitive is limited to the dylib's own __DATA segment and requires a first-stage exploit to target system dylib GOT entries.
  • The evidence packet reports complete_artifact_coverage is false, indicating some files (4 unclassified files) were not included in the analysis.
  • 4 files (Makefile, blog/it/dyld-signing-oracle.md, blog/en/dyld-signing-oracle.md, and one unlisted file) were omitted from the text evidence; their content was not reviewed.
  • The review is based solely on static source code analysis; no dynamic execution or binary analysis was performed.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Linked vulnerabilities

1