Saar Amar, a security researcher, writes about iOS internals, memory safety mitigations, and vulnerability analysis in Apple's kernel and bootloader.
HN commenters cite his posts on Apple's Firebloom memory-safe C in iBoot and his survey of memory safety mitigations such as Arm MTE.
Probabilistic Arm MTE memory safety is a stepping stone to deterministic CHERI hardware, https://saaramar.github.io/memory_safety_blogpost_2022/ & https://news.ycombinator.com/item?id=39668053
The right kind of mitigations targets the 1st order primitive; the root cause of the bug. Hardware solutions: CHERI (Morello, CheriIoT), MTE Software mitigations: kalloc_type+dataPAC, AUTOSLAB, Firebloom, GuardedMemcpy, CastGuard, attack surface reduction Safe programming languages: Rust, Swift MTE/CHERI play pretty nicely - they help ensure that whatever bugs we have in these areas are killed at their root cause… MSR, MSRC and Azure Silicon pushed for… scaling CHERI down to RISC-V32E, the smallest core RISC-V specification. Microsoft Research open-sourced a hardware/software stack for CHERI in IoT devices, https://msrc.microsoft.com/blog/2023/02/first-steps-in-cheriot-security-research/
CHERI-based microcontroller that aims to… get very strong security guarantees if we are willing to co-design the instruction set architecture (ISA), the application binary interface (ABI), isolation model, and the core parts of the software stack… our microcontroller achieves the following security properties: Deterministic mitigation for spatial safety (using CHERI-ISA capabilities). Deterministic mitigation for heap and cross-compartment stack temporal safety (using a load barrier, zeroing, revocation, and a one-bit information flow control scheme). Fine-grained…
I like to share this every time there's a post about memory safe C:
Apple has a memory-safer C compiler/variant they use to compile their boot loaders:
https://saaramar.github.io/iBoot_firebloom/
Saar Amar, who works at MSRC, wrote a writeup & POC for what he says is the same bug:
https://saaramar.github.io/IOMobileFrameBuffer_LPE_POC/
He says he found it independently.
Annotations on top of C, compiled through their private fork of LLVM. Here's what it looks like on our side: https://saaramar.github.io/iBoot_firebloom/
Initial vulnerability is OOB read, but it can be leveraged to gain arbitrary r/w.
EDIT: source: https://saaramar.github.io/IOMobileFrameBuffer_LPE_POC/
Many years ago. It’s called Firebloom. I think it’s similar in theory and lineage to Fil-C.
https://saaramar.github.io/iBoot_firebloom/