Simple macOS kernel extension fuzzing in userspace with IDA and Tiny Inst
Summary: Google Project Zero's Ivan Fratric described a method for fuzzing Apple's AppleAVD kernel extension, which handles much of AV1 format parsing in software on devices from Apple A17 iOS and M3 macOS, by loading the kernel code into userspace via IDA Pro's kernel cache loader and rebasing it. The approach replaces kernel allocator and hardware-communication functions such as AppleAVD::sendCommandToCommandGate with stubs and uses a custom TinyInst LiteCov-based module to collect code coverage.
Why it matters: The AV1 parsing code runs inside the kernel, so any bug found here sits at the highest privilege level on Apple devices - and Fratric notes the hardware-communication function was replaced because the decoding hardware isn't even present on the fuzzing machine.
Read the original at Google Project Zero ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026