Towards the next generation of XNU memory safety: kalloc_type
I’m a bit curious how this confers a security advantage. Isn’t the kernel clearing free pages before handing them out? Or does it not bother when it’s a kernel allocation?<p>If the latter, wouldn’t that be an obvious risk mitigation without even needing to segment by type (ie only hand out zeroed pages for allocations)?<p>If they’re being zeroed out, then I’m not sure I understand how grouping by type improves UAF security since the attacker couldn’t control the contents.<p>I’m sure I’m just ignorant here since there’s so much research into this type of hardening. Genuinely curious.