First public macOS kernel memory corruption exploit on Apple M5

First known exploit of Apple's silicon memory protection in the M5 chip.

The latest flagship example is MIE (Memory Integrity Enforcement), Apple's hardware-assisted memory safety system built around ARM's MTE (Memory Tagging Extension). It was introduced as the marquee security feature for the Apple M5 and A19, specifically designed to stop memory corruption exploits, the vulnerability class behind many of the most sophisticated compromises on iOS and macOS.

Apple spent five years building it. Probably billions of dollars too. According to their research, MIE disrupts every public exploit chain against modern iOS, including the recently leaked Coruna and Darksword exploit kits.

Mythos played a key role here:

We didn't build the chain alone. Mythos Preview helped identify the bugs and assisted throughout exploit development.

Mythos Preview is powerful: once it has learned how to attack a class of problems, it generalizes to nearly any problem in that class. Mythos discovered the bugs quickly because they belong to known bug classes. But MIE is a new best-in-class mitigation, so autonomously bypassing it can be tricky. This is where human expertise comes in.

Part of our motivation was to test what's possible when the best models are paired with experts. Landing a kernel memory corruption exploit against the best protections in a week is noteworthy, and says something strong about this pairing.

The bolding is mine. Apple spent five years creating this defensive structure and this small team armed with Mythos found a vulnerability in five days. We can, and probably should, look on the bright side that going forward every company building stuff like this will be using Mythos (or better) on their solutions before they are released. So we should raise the bar materially that solutions are secure.

There has to be a finite number of security vectors. Maybe we end up in a great place after uncovering these issues.