CVE-2013-5160

Vulnerability

CVE-2013-5160 is a NULL pointer dereference vulnerability in the Passcode Lock screen of Apple iOS prior to version 7.0.2 on iPhone devices [1]. When the emergency-call button is tapped repeatedly, the lock screen undergoes a NULL dereference that triggers a restart. During this restart window, the call dialer fails to obtain the lock screen state and incorrectly assumes the device is unlocked, allowing non-emergency numbers to be dialed [1]. The issue affects iPhone 4 and later models running iOS versions before 7.0.2 [1].

Exploitation

To exploit this vulnerability, an attacker must have physical access to the target iPhone [1]. The attack requires the user to repeatedly tap the emergency-call button, which is always visible on the lock screen [1]. No authentication or special privileges are needed beyond being able to interact with the device's touch screen. The repeated taps cause a race condition where the lock screen crashes and restarts, during which the dialer briefly misinterprets the device state as unlocked [1]. The precise sequence is: rapid taps on the emergency-call button -> NULL dereference -> lock screen restart -> dialer exposed -> attacker can dial any number before the lock screen reasserts itself [1].

Impact

A successful exploit allows an attacker to bypass the passcode requirement and dial arbitrary telephone numbers, including non-emergency numbers, without unlocking the device [1]. This can lead to unauthorized calls, which may incur charges or be used for malicious purposes, but the attacker cannot access other data or apps on the phone [1]. The impact is limited to telephony dialing and does not grant broader access to the device's file system, messages, or contacts. The privilege level is essentially the same as having a temporarily unlocked phone for dialing only [1].

Mitigation

Apple addressed this vulnerability in iOS 7.0.2, which was released on September 26, 2013 [1]. Users should update their iPhones to iOS 7.0.2 or later via Settings > General > Software Update [1]. No workaround is documented; the fix involves avoiding the NULL dereference in the lock screen code [1]. The vulnerability is not listed on the CISA Known Exploited Vulnerabilities (KEV) catalog as of the publication date [1].