Kaspersky researchers published a detailed technical analysis on Securelist revealing the complete exploit chain of Operation Triangulation — a zero-click iMessage attack against iOS devices up to iOS 16.2 that used four zero-day vulnerabilities, including what Kaspersky describes as the most sophisticated attack chain they have ever analyzed. The final and most distinctive element is the exploitation of an undocumented Apple hardware feature — GPU coprocessor CoreSight MMIO debug registers absent from device tree firmware definitions — to bypass the hardware-based Page Protection Layer (PPL).
Four-Zero-Day Chain: ADJUST TrueType Font, JavaScriptCore DollarVM, XNU Integer Overflow, and Hardware PPL Bypass
The attack begins with a zero-click malicious iMessage attachment exploiting CVE-2023-41990 — a remote code execution vulnerability in the undocumented Apple-only ADJUST TrueType font instruction present since the early 1990s. Return/jump-oriented programming and NSExpression/NSPredicate query language stages patch the JavaScriptCore environment to execute an 11,000-line obfuscated JavaScript privilege escalation exploit. The JavaScript exploit abuses the JavaScriptCore debugging feature DollarVM ($vm) for memory manipulation and native API execution, with PAC (Pointer Authentication Code) bypass for recent iPhone models. CVE-2023-32434, an integer overflow in XNU memory mapping syscalls (mach_make_memory_entry and vm_map), provides read/write access to the full physical memory at user level. CVE-2023-38606 exploits undocumented hardware MMIO registers to bypass PPL. A Safari stage uses CVE-2023-32435 for shellcode execution, followed by a Mach object file kernel exploit reusing CVE-2023-32434 and CVE-2023-38606.
The Hardware Mystery: Undocumented GPU CoreSight MMIO Registers at 0x206040000–0x206150000
The CVE-2023-38606 exploit writes data, destination address, and a data hash (later identified by Hector Martin as a Hamming ECC with custom lookup table) to hardware registers at addresses 0x206040000, 0x206140000, and 0x206150000 — none of which appear in Apple device tree firmware definitions for any known MMIO range. Kaspersky confirmed these belong to the GPU coprocessor (gfx-asc) by correlating proximity to documented gfx-asc ranges, matching the exploit's initialization code to the ml_dbgwrap_halt_cpu function from XNU's dbgwrap.c (ARM CoreSight MMIO debug registers), and triggering a "GFX SERROR Exception" GPU coprocessor panic when directly accessing the registers. The 0x206040000 register corresponds to the proprietary Apple UTT CoreSight region — which unlike the ARM-standard ED, CTI, and PMU regions is undocumented and Apple-specific. Registers 0x206140008 and 0x206140108 control enabling/disabling the hardware feature. The Hamming ECC discovery led to the conclusion that this feature provides direct access to GPU cache — but how the attackers discovered the existence, location, and interaction order of these registers without any firmware reference remains unexplained.