10 ms·
First public macOS kernel memory corruption exploit on Apple M5
- vsgherzi 5mo agounfortunately a little light on the details. I'm very curious how the bug survived through MTE
- dorianmariecom 5mo agoMemory Tagging Extension Arm published the Memory Tagging Extension (MTE) specification in 2019 as a tool for hardware to help find memory corruption bugs. MTE is a memory tagging and tag-checking system, where every memory allocation is tagged with a secret. The hardware guarantees that later requests to access memory are granted only if the request contains the correct secret. If the secrets don’t match, the app crashes, and the event is logged. This allows developers to identify memory corruption bugs immediately as they occur. https://support.apple.com/guide/security/operating-system-integrity-sec8b776536b/web https://support.apple.com/guide/security/operating-system-in...
- sillysaurusx 5mo agoThank you. I was about to ask.
- vsgherzi 5mo agoUpon further reading on data only attacks (https://www.usenix.org/publications/loginonline/data-only-attacks-are-easier-you-think https://www.usenix.org/publications/loginonline/data-only-at...) This makes more sense. You don't trigger MTE since you're not doing anything for force MTE to take action the program isn't actually changing. My other question would be, why didn't apple use fbounds checking here? They've been doing it aggressively everywhere else. MTE plus fbounds checking everywhere should lead to an extremly hardened OS
- pjmlp 5mo agoQuite strange indeed, given that was one of the main points on their security conference a few months ago.
- vsgherzi 5mo agoI can only imagine that 1. it’s to performance sensitive Or 2. The os is so darn large it’s hard to recompile everything
- kenferry 5mo agoI worked at Apple for a long time. The OS gets fully recompiled regularly. A simultaneous total world build is relatively rare (is that needed here?), but it does happen. Sometimes new compiler versions or features need this.
- vsgherzi 5mo agoHm that leaves more questions for me. Why does this path not have bounds checking, is think perhaps a limit of the clang flag or is it more simply a mistake of omission on apples part. Either way it seems like a bad look. I wish we’d get a post mortem
- asimovDev 5mo agoI dunno if that's sensitive information, but how long did a build usually take?
- kenferry 4mo agoI wasn't close enough to that to know how long a world build took. Didn't seem like it was too crazy though. Incremental (non-world) builds of the OS come out every day.
- aiscoming 5mo agocould be a different type of data only attack, which doesnt override the boundaries
- landr0id 5mo agoGPU memory/shaders/etc. isn't protected by MTE or PAC. They said "data-only", so I guess GPU commands could fit into this description.
- LoganDark 5mo agoIIRC, the GPU is behind a memory controller, so I doubt corrupting GPU memory alone could lead to an LPE. But I suppose it would give you someplace to store stuff if you can make something else read from it.
- traceroute66 5mo ago> I'm very curious how the bug survived through MTE Its not the first time bugs get past MTE, happened with Google Pixel last year ... https://github.blog/security/vulnerability-research/bypassing-mte-with-cve-2025-0072/ https://github.blog/security/vulnerability-research/bypassin...
- Riany 5mo agoI had the same question and if this is a data-only attack, the lesson may be that MIE reduces many attack paths but does not remove every useful corruption primitive
- AgentME 5mo ago[flagged]
- baq 5mo agoCisco put up a totally bogus 10.0 CVE just for this reason, too
- bstsb 5mo agoapple didn't "make up" this vulnerability, it was an external team reporting an issue
- oompydoompy74 5mo agoThe commenter was being sarcastic to highlight the current trend of dismissing Mythos, and LLM’s finding security vulnerabilities in general, as a non issue.
- UqWBcuFx6NV4r 5mo ago[flagged]
- bredren 5mo agoDid the article get edited? There is not much description of the field trip.
- yieldcrv 5mo agofrom what they demonstrated, this seems to only be a $100,000 exploit in Apple's bug bounty platform, but if they package it right, it could be a $1.5 million exploit They simply have to show it against a beta version of MacOS, and frame it as unauthorized access, and maybe from locked mode if possible
- vsgherzi 5mo agoThis is an lpe I believe what you’re describing is a zero click rce.
- commandersaki 5mo agoI bought the M5 specifically cause of MIE. Now I feel dumb.
- vsgherzi 5mo agoYou shouldn’t, MTE blocks a large chunk of vulnerabilities and makes things like rop and jop very difficult if not impossible now.
- commandersaki 5mo agoI should've added /s.
- vsgherzi 5mo agoIt’s unironically a good question :)
- aiscoming 5mo agoyou should worry about npm/pypi malware, not memory corruption bugs
- dgellow 5mo agoThe world is so not ready for the impact of LLMs on security issues. If true, congrats to the Calif team. It’s likely too technical for me to understand in details but looking forward to reading the 55 pages report
- iqihs 5mo agoyou're assuming that blue teams and engineers are sitting around twiddling their thumbs
- dgellow 5mo agoNot at all. I’m considering that the amount of vulnerable software in the wild is very, very large, with most organizations not managing their systems properly. Imagine all the small to medium size companies that do not have budgets for a dedicated, talented security team. And all the software that will never be patched. We are at the beginning of the exponential
- bottlepalm 5mo agoIt makes you think will everything need to be rewritten from the ground up - potentially by AI itself, or AI having a very heavy hand in validating all of it.
- Gigachad 5mo agoThere's so much much lower hanging fruit. Every job I've had has had basically everything massively out of date. Just keeping packages and framework versions up to date is a full time job and none of these companies have someone assigned to doing it. So much out of date software with known exploits left running for years. The only reason there hasn't been total disaster is no one has tried to hack it yet.
- bottlepalm 5mo agoRight and with AI now we have the ability to try hacking everything all at once.
- tkel 5mo ago[flagged]
- pertymcpert 5mo agoThese people don’t work for Apple or Anthropic.
- jp0001 5mo agoLLMs are going to produce amazing Rube Goldberg style vulnerabilities for years to come. It's already starting, this instance isn't the case, but it's happening.
- tweakimp 5mo agoDo you mean by vibecoding these vulnerabilities into the kernel or by finding them?
- shpx 5mo agoMaybe it's physically impossible to build a theoretically secure system, just as it's (presumably) impossible to have a cell that isn't susceptible to any virus. Maybe this whole time we've been getting away with a type of security by obscurity, where the obscurity is just no one having the time and focus to actually analyze the code.
- txhwind 5mo agoanother "obscurity": I'm not valuable enough to be attacked, compared with the cost. But what if cost has been reduced a lot?
- JacobKfromIRC 5mo agoSuppose the following: 1. Any given system has a finite number of findable vulnerabilities. 2. All findable vulnerabilities are fixable (if not in software then with a new hardware revision). 3. Fixing a vulnerability while keeping the same intended functionality introduces on average less than 1 other findable vulnerability. 4. It is possible to cease adding new features to a system and from that point forward only focus on fixing vulnerabilities. If all 4 are true, then perfect security seems possible, in some sense. I think some vulnerabilities might not be fixable, if you include things like the idea that users can be tricked into revealing their passwords. If you restrict the definition of vulnerability to some narrower meaning that still captures most of what people mean when they say computer vulnerability, then I think those 4 statements are probably true. Perfect security might be near impossible in practice because vulnerabilities will get more difficult to find and fix over time, but I think we should expect the discovery of vulnerabilities to eventually become arbitrarily slow in a hypothetical system that prioritized security above all else.
- isodev 5mo agoI’m surprised Apple is still not dogfooding their allegedly safe language Swift. Or was the whole exercise of Swift 6 mostly marketing
- vsgherzi 5mo agoSwift is definitely being used at apple. Most recently added as a CSS parser in safari and running embedded in some of the secure enclave parts. I know there was talk from as far back as strangeloop to get it in the kernel but I'm not sure how far that has gone. That being said they've been huge proponents of fbounds check in clang which can achieve a small portion (but important!) of what memory safe languages can do. I'd also like to see more swift or alternative adoptions I think they have potential and more competition in the safe language space is always welcome.
- nielsbot 5mo agoYou might be interested in the Strict Memory Safety option https://docs.swift.org/compiler/documentation/diagnostics/strict-memory-safety/ https://docs.swift.org/compiler/documentation/diagnostics/st...
- pjmlp 5mo agoThey certainly are, one of the reasons behind Embedded Swift is to replace iBoot firmware currently written in a C dialect similar in ideas to Fil-C, with something better. However it is no different from the Linux kernel, just because Rust is now allowed, the world hasn't been rewriten, and no sane person is going to do a Claude rewrite of the kernel.
- nicktaobo 5mo ago[dead]
- andai 5mo agoSo like ... I thought Mythos was just a bunch of hype? Or maybe the researchers are having their skills boosted due to using a model with such a cool name? I jest, but I did notice having more confidence to take on more ambitious work lately. We're all centaurs now.
- traceroute66 5mo ago> I thought Mythos was just a bunch of hype? My opinion is that it is over-hyped because like any LLM, it requires a suitable human in the loop to keep the LLM on the straight and narrow, and then to weed through the inevitable false-positives and hallucinations. Nicholas Carlini, for example, whose name is on many of the recent high-profile Mythos findings is not just some random dude with a Claude sub on his credit card .... he's an experienced security researcher. Random inexperienced people thinking Mythos can replace the need for experienced pen-testers, auditors etc. are likely to be sorely disappointed if/when they get their hands on Mythos.
- smallnix 5mo ago> likely to be sorely disappointed if/when they get their hands on Mythos. At first they will be delighted. So much money and time saved. When their adversaries get their hands on their system (with or without Mythos), then they'll be sorely disappointed.
- wslh 5mo agoI think it's worth to look at the recent XBOW benchmark: https://xbow.com/blog/mythos-offensive-security-xbow-evaluation https://xbow.com/blog/mythos-offensive-security-xbow-evaluat... they realized that ChatGPT 5.5 works better so the secret is in the architecture (including humans in the loop).
- baq 5mo ago'frontier tokens are not fungible'
- heresie-dabord 5mo ago
- yellow_lead 5mo agoDid Mythos have access to Apple's source code? > Apple spent five years building it. Probably billions of dollars too. This seems higher than I'd expect.
- remix2000 5mo ago[dead]
- dindresto 5mo agoThe macOS kernel (XNU) as well as the basic system underneath macOS (darwin) is open source. https://github.com/apple-oss-distributions/xnu https://github.com/apple-oss-distributions/xnu
- Someone 5mo agoI wouldn’t know whether that’s true, but this is partly hardware. That tends to make things more expensive, as, at some point, design bugs get really expensive both in time and in dollars, and chances are there were design bugs late in the process (e.g. because somebody published a new way of attacking a system that the latest design didn’t anticipate) Also, Apple claims it was an effort spanning half a decade (https://security.apple.com/blog/memory-integrity-enforcement/ https://security.apple.com/blog/memory-integrity-enforcement...), so depending on what you consider part of this (for example, do you include time spent on their secure memory allocator, on designing/implementing the ARM Memory Tagging Extension or Extended Memory Tagging Extension in the costs of this feature?),
- fguerraz 5mo agoThis is incredibly light in details, no verifiable claim as far as I can tell. (I’m sure they’re not lying, but we’re not learning anything here)
- unaut 5mo agoWell, this was fun read. Discovering such a high-ranking critical exploit within a week by coupling experts with frontier models is an amazing new journey we're about to embark on.
- teiferer 5mo ago> amazing new journey we're about to embark on. Is it? It's an arms race between the "good guys / defenders" and "bad guys / attackers". Assuming both sides have access to the same tools, how is this going to make any difference? Their relative strength will stay the same. What is actually different is that 1. anybody without tool access is out of the game, which includes security professionals from poorer backgrounds (for them it's not too amazing of a journey) and 2. the AI vendors get a constant stream of what's essentially an AI tax from everybody - so yeah, for them it's gonna be an amazing ride.
- Tuna-Fish 5mo agoMeh. A world where the defenders and attackers are both omniscient is a world without exploits. Steps towards that world are steps towards more security. The reason the exploits are being found so rapidly is that they are mining all the bugs left in these projects from decades of coding. Eventually they will run out.
- asdff 5mo agoPretty soon people will just airgap their stuff and that will eliminate most of the attack surface short of a sort of Mission Impossible style operation. I mean really, given how AI is being marketed, what is the point of the internet going forward when all its contents are going to be ai slop anyhow? Just disconnect and run local models if all you are getting is slop anyhow. The original purpose of the internet is now dead. Real people communicating and sharing information with eachother? Ha! That is no longer valued. In fact actual innovation might no longer be valued anymore. What is innovation but opening Pandora's box and potentially seeing a disruptive competitor take your slice of the federal reserves money print? Better to nip that in the bud and control all the devils we already know, from a pure sociopathic profitmaking standpoint, which seems to be a very dominant viewpoint among the people in charge of the worlds power structures right now.
- MrWiffles 5mo agoWait a minute - clearly I missed something here. Last I read, Mythos was only available to a handpicked list of megacorps under project glasswing. Did the hourly changing AI soap opera air yet another plot twist that I missed amidst my quest better known as “trying to find a job”? If not, how’d a small time outfit get access to something the rest of us can’t have because we’re (apparently) not trustworthy enough? No shade on these guys - I’m thinking it’s just another plot twist in “Hours of AI’s Lives”.
- tempaccount420 5mo agoI'm guessing they have some friends at Anthropic.
- xuancanh 5mo agoThey list Anthropic as one of their customers and appear to have conducted penetration testing for them previously, so they're likely one of those trusted organizations.
- djwatson24 5mo ago> We wanted to check out the infamous Infinite Loop too, but were afraid it could take a long time. Haha! Nerd jokes are the best jokes