The core of Apple is PPL: Breaking the XNU kernel's kernel
Summary: Google Project Zero researcher Brandon Azad found a memory corruption flaw in pmap_remove_options_internal(), a PPL routine in Apple's XNU kernel, where a virtual address range crossing an L3 translation table boundary causes out-of-bounds TTE removal and a mismatch between the TTEs removed and the TLB entries invalidated. The bypass, reported as Project Zero issue 2035 and fixed in iOS 13.6, uses a stale TLB entry to write an L3 TTE that maps a page table page as writable, allowing arbitrary physical addresses to be mapped into EL0.
Why it matters: PPL exists specifically to stop an attacker who already has kernel read/write/execute from modifying page tables, and this bug let a stale TLB entry defeat exactly that boundary - the layer Apple treats as more privileged than the rest of the kernel.
Read the original at Google Project Zero ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026