First public macOS kernel memory corruption exploit on Apple M5
458 points
• 4 days ago
• Article
Link
Calif 在安全研究领域取得了重要里程碑：他们开发出首个公开的针对 Apple M5 上 macOS 内核内存破坏的漏洞利用，成功绕过了 Apple 的 Memory Integrity Enforcement（MIE）机制。该利用仅在与 Mythos Preview 合作的五天内完成，表明即便是最先进的硬件级安全防护，也可能在 AI 辅助与人类专业知识的配合下被攻破。
Apple 花了五年、投入数十亿美元开发 MIE，这是一种基于 ARM Memory Tagging Extension 的硬件辅助内存安全机制。作为 M5 和 A19 芯片的旗舰安全功能，MIE 专门用于阻止内存损坏类漏洞利用——这类漏洞历来是 iOS 和 macOS 上最常见的漏洞类型。根据 Apple 的研究，MIE 能使所有已知针对现代 iOS 的公开漏洞利用链失效，包括 Coruna 和 Darksword 等复杂工具包。
Calif 团队的攻击路径属偶然发现。 Bruce Dang 在 4 月 25 日发现了底层漏洞；一周内，Dion Blazakis 加入，Josh Maine 搭建了工具链，他们在 5 月 1 日就完成了可用的漏洞利用链。该链针对 macOS 26.4.1，从非特权本地用户出发，仅借助常规系统调用，即可在内核 MIE 完全启用的裸机 M5 硬件上获取 root 权限。
Mythos Preview 在发现这些漏洞方面发挥了关键作用——这些漏洞属于该 AI 系统已学会如何高效攻击的已知类别。但 MIE 作为一种顶级缓解措施，需要人类专业知识才能被绕过。人机配合表现出惊人效率，约一周内就在消费级最强防护下实现了内核漏洞利用。
这项工作预示了安全领域的未来：Apple 在像 Mythos Preview 这样的 AI 系统出现之前设计并部署了 MIE 。随着这些系统持续发现更多漏洞，必然会出现一些能够在高级缓解下幸存的强大漏洞。该团队亲赴 Apple Park 递交了他们的发现，并以激光打印的报告向黑客文化致敬；他们计划在 Apple 发布修复后公开一份完整的 55 页技术报告。
Calif has achieved a significant milestone in security research by developing the first public macOS kernel memory corruption exploit on Apple M5 silicon, successfully bypassing Apple's Memory Integrity Enforcement (MIE) system. The exploit, built in just five days in collaboration with Mythos Preview, demonstrates that even Apple's most advanced hardware-based security protections can be evaded with the right combination of AI assistance and human expertise.
Apple spent five years and billions of dollars developing MIE, a hardware-assisted memory safety system built around ARM's Memory Tagging Extension. Introduced as the flagship security feature for the M5 and A19 chips, MIE was specifically designed to stop memory corruption exploits, which have historically been the most common vulnerability class on iOS and macOS. According to Apple's own research, MIE disrupts every known public exploit chain against modern iOS, including sophisticated kits like Coruna and Darksword.
The Calif team's attack path was actually an accidental discovery. Bruce Dang found the underlying bugs on April 25th, and within a week, with Dion Blazakis joining and Josh Maine building the tooling, they had a working exploit by May 1st. The chain targets macOS 26.4.1, starting from an unprivileged local user and using only normal system calls to achieve root access on bare-metal M5 hardware with kernel MIE fully enabled.
Mythos Preview played a crucial role in identifying the vulnerabilities, which belong to known bug classes that the AI system has learned to attack effectively. However, MIE represented a new best-in-class mitigation that required human expertise to bypass autonomously. The pairing proved remarkably effective, landing a kernel exploit against the strongest consumer platform protections in about a week.
This work signals what's coming in the security landscape. Apple built MIE in a world before AI systems like Mythos Preview existed. As these systems discover more vulnerabilities, some will inevitably be powerful enough to survive even advanced mitigations. The team delivered their findings in person at Apple Park, laser-printing the report as a nod to hacker culture, and plans to publish a full 55-page technical report after Apple ships a fix.
128 comments • Comments Link
此次讨论聚焦于 Apple 操作系统中新披露的一个安全漏洞，该漏洞绕过了内存标记扩展（MTE）——一种用于防止内存破坏利用的硬件级防护。评论者对这类漏洞的更广泛影响表示担忧，尤其考虑到大多数组织缺乏专门的安全团队或资源来及时修补系统。该漏洞似乎采用"纯数据"攻击手法，通过不改变控制流来规避 MTE，这也引发了为什么 Apple 没有同时采用 fbounds 检查等额外防护的疑问。有人推测，性能顾虑或需要重新编译整个操作系统的复杂性可能是主要原因。关于该漏洞在 bug bounty program 中的价值也存在争议，估价从 10 万美元到 150 万美元不等，取决于演示方式，尤其是在测试版系统或 Lockdown Mode 下演示时更有价值。还有人指出，这并非 MTE 首次被绕过，并引用了 Google Pixel 上的类似案例。尽管 MTE 通过阻止 ROP 和 JOP 等常见利用技术显著提高了攻击门槛，但此事凸显出没有任何单一防护是万无一失的，尤其当攻击者转向针对 GPU 内存等未受保护子系统时。此次讨论反映了人们对在日益复杂且受 AI 辅助的漏洞发现面前，防御措施能否实现可扩展性的日益担忧。 The discussion centers on a newly disclosed security vulnerability in Apple's operating system that bypasses Memory Tagging Extension (MTE), a hardware-level defense mechanism designed to prevent memory corruption exploits. Commenters express concern about the broader implications of such vulnerabilities, especially given that most organizations lack dedicated security teams or resources to patch systems promptly. The exploit appears to use a "data-only" attack technique, which avoids triggering MTE by not altering control flow, raising questions about why Apple didn't also employ additional protections like fbounds checking. Some speculate performance concerns or the complexity of recompiling the entire OS may explain the gap. There's also debate over the exploit's value in Apple's bug bounty program, with estimates ranging from $100,000 to $1.5 million depending on how it's framed, particularly if demonstrated against a beta OS or in locked mode. Others note this isn't the first time MTE has been bypassed, citing a similar case on Google Pixel. While MTE significantly raises the bar for attackers by thwarting common exploit techniques like ROP and JOP, this incident underscores that no single mitigation is foolproof, especially as adversaries adapt to target unprotected subsystems like GPU memory. The conversation reflects growing anxiety about the scalability of defenses in the face of increasingly sophisticated, AI-assisted vulnerability discovery.