Researchers at cybersecurity firm Paradigm Shift have disclosed a newly identified exploit, dubbed usbliter8, that bypasses fundamental boot security protections on millions of older Apple devices, including iPhones powered by A12 and A13 chips.
The research describes an attack targeting SecureROM, the very first code executed when an Apple device powers on and the foundation of Apple’s secure boot architecture. Because SecureROM is permanently embedded into hardware during manufacturing, vulnerabilities at this level cannot be patched through standard software updates.
According to the researchers, the exploit combines a hardware flaw in the USB controller with a firmware configuration weakness to compromise Apple’s secure boot chain and achieve low-level system access.
“By publishing this research and the accompanying proof of concept, we aim to document the real-world impact of this class of hardware vulnerabilities, contribute to the broader understanding of modern BootROM security, and demonstrate that even recent SecureROM generations remain susceptible to subtle hardware flaws,” Paradigm Shift wrote in its disclosure.
How the Usbliter8 vulnerability works
According to Paradigm Shift, the vulnerability originates from the Synopsys DWC2 USB controller integrated into the affected chips.
The controller processes incoming USB setup data using Direct Memory Access (DMA). The researchers discovered a discrepancy in how the controller handles incoming Setup packets and resets its DMA memory pointer. Under carefully controlled conditions, this mismatch causes the pointer to move backwards, allowing it to overwrite memory regions that should remain inaccessible.
On affected A12 and A13 devices, Apple’s SecureROM configuration leaves the USB Data Address Resolution Table (DART) configured in a way that permits unintended DMA writes into sensitive system memory. As a result, the exploit provides a path to hijack processor execution before Apple’s signed boot chain is fully initialized.
The DesignWare USB controller is capable of storing up to three consecutive Setup packets in memory.
When a fourth Setup transaction is received, the DMA base address is reset to its initial position before the new data is written, effectively behaving like a ring buffer.
After each Setup packet is written, the controller increments the DOEPDMA pointer by the amount of data received. However, the reset logic always subtracts a fixed 24 bytes from DOEPDMA.
The underlying flaw exists because the controller also accepts smaller Setup packets while still storing them in 4-byte aligned chunks.
Since the pointer increment varies with packet size while the reset operation always subtracts 24 bytes, the resulting mismatch creates a buffer underflow primitive in 12-byte increments. A detailed write-up can be found here.
Affected devices
The current implementation of the exploit supports Apple chips including A12, A13, S4, and S5, covering devices such as the iPhone XS, iPhone XR, iPhone 11 lineup, and Apple Watch Series 4 and Series 5.
The researchers also noted that support for A12X and A12Z processors may be feasible in the future, although these platforms are not supported by the current proof of concept.
So here is the list of all supported devices:
A12 Bionic
- iPhone XS
- iPhone XS Max
- iPhone XR
A12X Bionic
- iPad Pro 11-inch (1st generation)
- iPad Pro 12.9-inch (3rd generation)
A12Z Bionic
- iPad Pro 11-inch (2nd generation)
- iPad Pro 12.9-inch (4th generation)
A13 Bionic
- iPhone 11
- iPhone 11 Pro
- iPhone 11 Pro Max
- iPhone SE (2nd generation)
Apple iWatch Series
- Apple Watch Series 4 (S4)
- Apple Watch Series 5 (S5)
Apple TV
- Apple TV 4k 2nd Gen
In the next article, we’ll take a closer look at what the usbliter8 BootROM exploit makes possible, examine its practical implications, and answer one of the biggest questions: can it lead to a new jailbreak for A12 and A13 devices?