We found a way to defeat pointer authentication (and forge kernel pointers from userspace) on the Apple M1 via a new hardware attack.
Hereโs how it works-
CVE-2025-24118 is an absolutely crazy race condition I found in the macOS / XNU kernel.
Safe memory reclamation, read-only objects, memcpy implementation details, and a race condition- oh my!
Writeup + Solution to "Mock Kernel"- an XNU kernel hacking CTF challenge I wrote for UIUCTF 2023 is now available: github.com/jprx/mock-kernโฆ
Includes software PAC added to the Mac OS X Snow Leopard kernel, plus using Mach OOL heap spray to exploit a UaF!
A big thank you to everyone who came to my @defcon talk on PACMAN!!
All of our Apple Silicon research tools, the complete PACMAN PoC, and slides from the talk can be found at pacmanattack.com/code.
Letโs say you want to rob a bankโฆ
Watch my talk @Forbes about the research weโre doing @MIT_CSAIL on how to build the next generation of secure computers!
youtu.be/QWPn3W3acew