Post #2509610
2025-09-09 18:50 UTC
Memory Integrity Enforcement is the culmination of a truly incredible amount of work :)
While there's so much to love, one of my favorite pieces was getting to bring kalloc_type-style isolation to out-of-bounds accesses on both the architectural and speculative path. This lets us both mitigate a variety of Spectre v1 style attacks and break the reliable exploitation of some of the most powerful first-order memory corruption primitives (arb offset OOB R/W).
https://security.apple.com/blog/memory-integrity-enforcement/
Replies (2)
-
@ezhes_@mastodon.online 2025-09-09 19:18
/2 The trick behind this mitigation is to use the compiler to clamp all pointer offset operations in kernel code to a magnitude of less than 4GB. If you feel like grep-ing, the specific codegen for this clamp operation currently uses a special 0x2BAD poisoning pattern in the top 16 bits when the magnitude exceeds 4GB. With some VA layout tricks to inject large 4GB unmapped gutters between major kernel VA regions, this has some delightful consequences.
-
@gabrielesvelto@mas.to 2025-09-09 20:43
@ezhes_@mastodon.online fascinating stuff. It's always interesting to read about these kind of multi-layered defense-in-depth mechanisms.