In a significant breakthrough, security researchers at Calif have successfully demonstrated a macOS kernel memory corruption exploit on the M5 silicon, overcoming Apple’s five-year investment in security measures within just five days. The exploit, facilitated by Mythos Preview, involved the strategic linking of two bugs and various techniques to compromise the Mac’s memory and access restricted areas of the device.
Apple's latest memory safety system, Memory Integrity Enforcement (MIE), was introduced to enhance security by utilizing Arm's Memory Tagging Extension (MTE). This system aims to prevent memory corruption attacks by tagging memory allocations and verifying access requests against these tags. Despite this robust framework, researchers noted vulnerabilities that allowed them to bypass MIE, which has recently been integrated into MacBooks with the M5 chip.
The Calif team shared additional insights into their method, including a 20-second video showcasing the exploit in action. Apple’s MIE has reportedly disrupted numerous public exploit chains against modern iOS, including the notorious Coruna and Darksword kits, marking a notable challenge for security researchers.