Towards the next generation of XNU memory safety: kalloc_type
I’m a bit curious how this confers a security advantage. Isn’t the kernel clearing free pages before handing them out? Or does it not bother when it’s a kernel allocation?If the latter, wouldn’t that be an obvious risk mitigation without even needing to segment by type (ie only hand out zeroed pages for allocations)?If they’re being zeroed out, then I’m not sure I understand how grouping by type improves UAF security since the attacker couldn’t control the contents.I’m sure I’m just ignorant here since there’s so much research into this type of hardening. Genuinely curious.