usbliter8: An Unpatchable BootROM-Level Vulnerability in Apple A12/A13 Exposed via USB

Summary

On June 18, 2026, the Paradigm Shift research team publicly disclosed usbliter8, an unpatchable BootROM/SecureROM-level vulnerability affecting Apple A12, A13, S4, and S5 SoCs. Like the 2019 checkm8 exploit, it is burned into the silicon at manufacture, cannot be patched via software, and requires only physical access and a USB connection to execute. It extends the class of "eternal" iPhone boot-chain flaws from A5–A11 to A12–A13, covering iPhone XS through iPhone 11.

Root Cause: A Third-Party USB Controller Bug

The vulnerability does not originate in Apple's own code but in the Synopsys DWC2 USB controller IP. Its DMA engine behaves as follows:

1. It buffers up to 3 USB Setup packets via DMA. 2. On the 4th packet, it resets the write pointer backward by a fixed 24 bytes. 3. However, it also accepts sub-standard sized packets and increments the pointer by the actual byte count.

Because the reset step is fixed at 24 bytes but increments scale with payload size, repeatedly sending packets smaller than 24 bytes causes the DMA write pointer to monotonically regress in address space—a buffer underflow into adjacent memory regions.

Why A11 and A14+ Are Safe, but A12/A13 Are Vulnerable

• A11: The USB driver manually resets the DMA address after each packet, preventing underflow accumulation.
• A12/A13 (vulnerable): The USB DART (Apple's IOMMU) inside SecureROM runs in bypass mode, so the DMA pointer can scribble anywhere in SRAM.
• A14+ (safe): DART is configured correctly, strictly bounding DMA.

The full exploit chain is therefore: USB IP hardware bug + Apple IOMMU misconfiguration = arbitrary SRAM write.

Exploitation Paths

A12

The DMA buffer sits next to the USB task's stack. The underflow overwrites a saved link register; the next context switch hijacks the program counter.

A13 (Bypassing PAC)

A13 introduces Pointer Authentication Code (PAC) on return addresses, so direct stack overwrites fail. Paradigm Shift's four-stage bypass:

1. Stage 1: Corrupt DART-related heap structures via the underflow to obtain a limited write primitive. 2. Stage 2: Overwrite the panic-depth counter so faults loop instead of resetting the SoC. 3. Stage 3: Use precise DMA write timing to avoid clobbering USB task's saved registers. 4. Stage 4: Overwrite the USB interrupt handler function pointer in BSS. 5. Result: The next USB interrupt executes attacker code at EL1 (kernel privilege).

Both paths converge on the same outcome: arbitrary code execution inside SecureROM at the highest privilege.

Post-Exploitation Capabilities

• Inject custom USB request handlers.
• Stamp "PWND:[usbliter8]" into the USB serial number.
• Temporarily downgrade the SoC out of production mode.
• Boot unsigned iBoot images, bypassing Apple's signing chain.
• Note: The Secure Enclave is not directly compromised, but a new attack surface is opened.

The core impact is bypass of the entire boot signing chain. Apple's trust model assumes BootROM is the absolute root of trust; once that root is poisoned, every higher layer becomes a house of cards.

Affected Devices

• A12: iPhone XS, XS Max, XR; iPad Air 3; iPad mini 5; iPad 8; Apple TV 4K (2nd gen)
• A13: iPhone 11, 11 Pro, 11 Pro Max; iPhone SE (2nd gen); iPad 9
• S4/S5: Apple Watch Series 4/5; Apple Watch SE (1st gen); HomePod mini

A12X/Z (2018/2020 iPad Pro) are theoretically vulnerable but no PoC exists yet.

checkm8 vs. usbliter8

| | checkm8 (2019) | usbliter8 (2026) | |--|----------------|------------------| | Target SoCs | A5–A11 | A12, A13, S4, S5 | | Layer | BootROM | SecureROM | | Patchable? | No | No | | Physical access required? | Yes | Yes | | Breaks Secure Enclave? | No | No | | Legacy | Spawned checkra1n and modern jailbreak tooling | Likely enables a new generation of forensic and jailbreak tooling |

Paradigm Shift summarized the work as: > "For those who have followed the history of iPhone exploitation and jailbreaking, this research is a reminder that the BootROM still occasionally has a surprise left to give."

What Users Should Do

General users: Do not panic. The flaw cannot be exploited remotely. An attacker must:

1. Obtain the physical device. 2. Enter DFU mode. 3. Connect it via USB to an RP2350 microcontroller board. 4. Run the exploit within a two-second window.

Practical guidance:

• Use a strong passcode.
• Do not let untrusted parties physically handle the device.
• Remotely wipe via Find My if lost.
• For sensitive work, move to A14+ or newer hardware.

Enterprise, government, and high-value targets: This is a permanent hardware-level vulnerability. Affected devices should be retired from sensitive roles or at minimum subject to strict physical-access controls.

Bottom Line

usbliter8 is not a remake of checkm8—it is its successor. Even with PAC and stronger memory protections on A12/A13, a third-party USB IP bug combined with a configuration mistake can collapse the entire boot trust chain. The code burned into chips at the factory is supposed to be the last line of defense; that line now has permanent cracks.

---

Source: Paradigm Shift team (ps.tc) Disclosure date: 2026-06-18 Disclosure method: Coordinated with Apple Product Security PoC: Publicly released License: Research use only