Apple on Tuesday revealed a brand new safety function known as Reminiscence Integrity Enforcement (MIE) that is constructed into its newly launched iPhone fashions, together with iPhone 17 and iPhone Air.
MIE, per the tech large, provides “always-on reminiscence security safety” throughout vital assault surfaces such because the kernel and over 70 userland processes with out sacrificing gadget efficiency by designing its A19 and A19 Professional chips retaining this facet in thoughts.
“Reminiscence Integrity Enforcement is constructed on the strong basis offered by our safe reminiscence allocators, coupled with Enhanced Reminiscence Tagging Extension (EMTE) in synchronous mode, and supported by in depth Tag Confidentiality Enforcement insurance policies,” the corporate famous.
The hassle is an goal to enhance reminiscence security and stop dangerous actors, particularly these leveraging mercenary spyware and adware, from weaponizing such flaws within the first place to interrupt into gadgets as a part of highly-targeted assaults.
The know-how that underpins MIE is EMTE, an improved model of the Reminiscence Tagging Extension (MTE) specification launched by chipmaker Arm in 2019 to flag reminiscence corruption bugs both synchronously or asynchronously. EMTE was launched by Arm in 2022 following a collaboration with Apple.
It is value noting that Google’s Pixel gadgets have already got help for MTE as a developer choice beginning with Android 13. Comparable reminiscence integrity options have additionally been launched by Microsoft in Home windows 11.
 |
| How MIE blocks use-after-free entry |
“The power of MTE to detect reminiscence corruption exploitation on the first harmful entry is a major enchancment in diagnostic and potential safety effectiveness,” Google Challenge Zero researcher Mark Model mentioned in October 2023, coinciding with the discharge of Pixel 8 and Pixel 8 Professional.
“The supply of MTE on a manufacturing handset for the primary time is a giant step ahead, and I believe there’s actual potential to make use of this know-how to make 0-day tougher.”
Apple mentioned MIE transforms MTE from a “useful debugging device” right into a groundbreaking new safety function, providing safety safety towards two widespread vulnerability lessons – buffer overflows and use-after-free bugs – that might end in reminiscence corruption.
 |
| How MIE blocks buffer overflows |
This primarily entails blocking out-of-bounds requests to entry adjoining reminiscence that has a distinct tag, and retagging reminiscence because it will get reused for different functions after it has been freed and reallocated by the system. Consequently, requests to entry retagged reminiscence with an older tag (indicating use-after-free situations) additionally get blocked.
“A key weak point of the unique MTE specification is that entry to non-tagged reminiscence, equivalent to international variables, shouldn’t be checked by the {hardware},” Apple defined. “This implies attackers do not should face as many defensive constraints when making an attempt to regulate core software configuration and state.”
“With Enhanced MTE, we as a substitute specify that accessing non-tagged reminiscence from a tagged reminiscence area requires figuring out that area’s tag, making it considerably tougher for attackers to show out-of-bounds bugs in dynamic tagged reminiscence right into a technique to sidestep EMTE by instantly modifying non-tagged allocations.”
 |
| Enabling MTE on Google Pixel |
Cupertino mentioned it has additionally developed what it calls Tag Confidentiality Enforcement (TCE) to safe the implementation of reminiscence allocators towards side-channel and speculative execution assaults like TikTag that MTE was discovered vulnerable to final yr, ensuing within the leak of an MTE tag related to an arbitrary reminiscence tackle by exploiting the truth that tag checks generate cache state variations throughout speculative execution.
“The meticulous planning and implementation of Reminiscence Integrity Enforcement made it doable to keep up synchronous tag checking for all of the demanding workloads of our platforms, delivering groundbreaking safety with minimal efficiency affect, whereas remaining utterly invisible to customers,” it added.
