Sep 10, 2025Ravie LakshmananSpyware / Vulnerability
Apple on Tuesday revealed a brand new safety function known as Reminiscence Integrity Enforcement (MIE) that is constructed into its newly launched iPhone fashions, together with iPhone 17 and iPhone Air.
MIE, per the tech large, affords “always-on reminiscence security safety” throughout essential assault surfaces such because the kernel and over 70 userland processes with out sacrificing system efficiency by designing its A19 and A19 Professional chips, preserving this side in thoughts.
“Reminiscence Integrity Enforcement is constructed on the sturdy basis offered by our safe reminiscence allocators, coupled with Enhanced Reminiscence Tagging Extension (EMTE) in synchronous mode, and supported by intensive Tag Confidentiality Enforcement insurance policies,” the corporate famous.
The hassle is an goal to enhance reminiscence security and forestall dangerous actors, particularly these leveraging mercenary spyware and adware, from weaponizing such flaws within the first place to interrupt into units as a part of highly-targeted assaults.
The expertise that underpins MIE is EMTE, an improved model of the Reminiscence Tagging Extension (MTE) specification launched by chipmaker Arm in 2019 to flag reminiscence corruption bugs both synchronously or asynchronously.
It is value noting that Google’s Pixel units have already got help for MTE as a developer choice beginning with Android 13. Comparable reminiscence integrity options have additionally been launched by Microsoft in Home windows 11.
“The flexibility of MTE to detect reminiscence corruption exploitation on the first harmful entry is a big enchancment in diagnostic and potential safety effectiveness,” Google Mission Zero researcher Mark Model stated in October 2023, coinciding with the discharge of Pixel 8 and Pixel 8 Professional.
“The supply of MTE on a manufacturing handset for the primary time is a giant step ahead, and I believe there’s actual potential to make use of this expertise to make 0-day tougher.”
Apple stated MIE transforms MTE from a “useful debugging software” right into a groundbreaking new safety function, providing safety safety towards two frequent vulnerability lessons – buffer overflows and use-after-free bugs – that would lead to reminiscence corruption.
This basically includes blocking out-of-bounds requests to entry adjoining reminiscence that has a distinct tag, and retagging reminiscence because it will get reused for different functions after it has been freed and reallocated by the system. Because of this, requests to entry retagged reminiscence with an older tag (indicating use-after-free situations) additionally get blocked.
“A key weak point of the unique MTE specification is that entry to non-tagged reminiscence, corresponding to international variables, isn’t checked by the {hardware},” Apple defined. “This implies attackers do not must face as many defensive constraints when making an attempt to manage core utility configuration and state.”
“With Enhanced MTE, we as an alternative specify that accessing non-tagged reminiscence from a tagged reminiscence area requires realizing that area’s tag, making it considerably tougher for attackers to show out-of-bounds bugs in dynamic tagged reminiscence right into a approach to sidestep EMTE by instantly modifying non-tagged allocations.”
Cupertino stated it has additionally developed what it calls Tag Confidentiality Enforcement (TCE) to safe the implementation of reminiscence allocators towards side-channel and speculative execution assaults like TikTag that MTE was discovered inclined to final 12 months, ensuing within the leak of an MTE tag related to an arbitrary reminiscence tackle by exploiting the truth that tag checks generate cache state variations throughout speculative execution.
“The meticulous planning and implementation of Reminiscence Integrity Enforcement made it doable to keep up synchronous tag checking for all of the demanding workloads of our platforms, delivering groundbreaking safety with minimal efficiency affect, whereas remaining utterly invisible to customers,” it added.
