Upon further reading on data only attacks

This makes more sense. You don't trigger MTE since you're not doing anything for force MTE to take action the program isn't actually changing.

My other question would be, why didn't apple use fbounds checking here? They've been doing it aggressively everywhere else.

MTE plus fbounds checking everywhere should lead to an extremly hardened OS

pjmlp 6 hours ago | parent | next [-]

Quite strange indeed, given that was one of the main points on their security conference a few months ago.

	▲	vsgherzi 5 hours ago \| parent [-]
		I can only imagine that 1. it’s to performance sensitive Or 2. The os is so darn large it’s hard to recompile everything

aiscoming 3 hours ago | parent | prev [-]

could be a different type of data only attack, which doesnt override the boundaries

	▲	vsgherzi 2 hours ago \| parent [-]
		Well it’s memory corruption so I think it’s pretty safe to assume it’s a bounds issue. I’m not sure if it’s possible to get this with something like type confusion tho I could be wrong here.