Thread by @DanyL931

Apple just released iOS 12.3, which includes patches for 3 vulnerabilities I discovered:
CVE-2019-8593
CVE-2019-8568
CVE-2019-8637

I’ll publish the exploits as soon as possible.

Note that the advisory is somewhat wrong.
I was too late to reply Apple to correct it, but I’ll make it clear when I publish my work.

Just to clarify - The exploits will open a wider attack surface which can be used to further exploit the device (with additional vulnerabilities).
They most likely be used for research purposes, unless someone is willing to disclose more vulnerabilities.

CVE-2019-8637 in particular allows arbitrary command execution - with any user, including root.
But a sandbox bypass is required to allow execution of Container apps with users other than mobile or _networkd.

I currently reversing iOS 12.3 to see how @Apple patched the vulnerabilities.

Please be patient.