What if we had the SockPuppet vulnerability in iOS 16?

This post examines how an old XNU kernel UAF would fare under the kalloc_type allocator. A key takeaway is that at least in the iOS kernel, randomized, bucketed type isolation seems able to put a practical upper bound on the per-boot exploit success rate for some vulnerabilities. For SockPuppet, we estimate that the best possible exploit might only succeed on 92% of booted systems, whereas it used to be 100% reliable. Kernel UAFs in general are still exploitable, but kalloc_type seems to make them notably less attractive.

https://security.apple.com/blog/what-if-we-had-sockpuppet-in-ios16/

If you want to come work and build the next kalloc_type(), blastdoor, lockdown mode, 🔥🌸 <insert your favorite mitigation or technology here>, then this is the team for you.

Its purpose is precisely that, and you’d be working with the people who’ve done the above and then some.

https://mastodon.social/@jacquesf/110107440666553492

This is the team I have actually joined SEAR to staff, and this is our mission statement: https://mastodon.social/@jacquesf/110107444554498266

And this is important to stress, we aren't necessarily looking for security experts as @jacquesf mentions in https://mastodon.social/@jacquesf/110107450707960028 several of us come from various non security backgrounds.

We're looking for a diverse crowd of generalists who have an affinity for security and want to continue the trend of making a difference in the vein of https://mastodon.social/@jacquesf/110107445178605599.