Kernel Exploitation on Apple's M1 chip

The talk looks at the Apple Video Encoder kernel driver, AppleAVE2, which runs in kernel space on iOS devices and, from the M1 generation, on Macs. The speaker explains why its complex code and heavy user-kernel memory mapping make it an attractive target. The driver first drew attention in 2017, when earlier research exposed simple flaws that Apple then patched.

The middle of the talk covers the speaker's own findings against the newer macOS build. These include an overflow missing a size boundary check and a race condition involving shared memory, both of which can be turned into kernel read and write primitives. The speaker compares how Apple addressed each bug, noting that the race fix added a buffer around part of the mapped memory while the overflow was handled differently. The argument is that minimal patches are common because thorough fixes take much more effort, so researchers should examine how their reports were actually fixed.

The closing section describes the speaker's experience with Apple's security bounty, including slow communication and a payout of about $52,000, and compares it with other disclosure programs. It also contrasts sandbox-reachable attack surface with externally reachable methods that need no sandbox escape, and briefly describes a race-based driver bug that can map physical memory. The talk ends with the view that macOS hardening has improved year after year, especially in the kernel.