Virtual Memory & Page Tables
The virtual memory subsystem manages translation between virtual addresses (used by code) and physical addresses (actual RAM). Page tables are the data structure holding this mapping. Bugs in the VM subsystem lead to physical read/write – the most powerful primitive.
Why You Need to Understand VM
- Physical UAF (PUAF) exploits target bugs in the VM subsystem
- Page table manipulation is how to bypass PPL/SPTM
- physrw (physical read/write) is achieved through dangling page table entries
- KASLR relies on VM – understanding VM = understanding how to leak the kernel base
- pmap code is a target for many kernel bugs
ARM64 Address Translation
Translation Table Walk
Virtual Address (48-bit):
┌────────┬────────┬────────┬────────┬──────────────┐
│ L1 idx │ L2 idx │ L3 idx │ Page │ Page offset │
│ [47:39]│ [38:30]│ [29:25]│ [24:14]│ [13:0] │
│ 9 bits │ 9 bits │ 5 bits │ 11 bits│ 14 bits │
└────────┴────────┴────────┴────────┴──────────────┘
(iOS uses 16KB pages → offset = 14 bits)
Translation:
TTBR1_EL1 (kernel) or TTBR0_EL1 (user)
│
▼
L1 Table ──[L1 idx]──→ L1 Entry → L2 Table base
│
▼
L2 Table ──[L2 idx]──→ L2 Entry → L3 Table base
│
▼
L3 Table ──[L3 idx]──→ L3 Entry
│
▼
Physical Page
+ offset
│
▼
Physical Address
Page Table Entry (PTE) Format
L3 Page Table Entry (arm64, 16KB granule):
┌─────────────────────────────────────────────────────────────┐
│ 63 59│58 55│54 52│51 14│13 12│11 10│9 8│...│
│ ignored │ SW │ res │ Output Addr │ res │ AP │ SH │...│
│ by HW │ use │ │ (phys page) │ │ │ │ │
├─────────────────────────────────────────────────────────────┤
│ ...│7 6│5│4 2│1│0│
│ │ res│ │MAIR│ │V│
│ │ │ │idx │ │a│
│ │ │ │ │ │l│
│ │ │ │ │ │i│
│ │ │ │ │ │d│
└─────────────────────┘
Key fields:
Bit 0 (Valid) : 1 = entry valid, 0 = fault on access
Bits 4:2 (AttrIdx): Memory attribute index (MAIR register)
Bits 7:6 (AP) : Access Permission
00 = EL1 R/W, EL0 no access
01 = EL1 R/W, EL0 R/W
10 = EL1 R/O, EL0 no access
11 = EL1 R/O, EL0 R/O
Bits 9:8 (SH) : Shareability (Inner/Outer/None)
Bit 10 (AF) : Access Flag (set by HW on first access)
Bit 54 (XN) : Execute Never (EL1)
Bit 53 (PXN) : Privileged Execute Never
Bits 51:14 : Physical address of page (shifted)
Address Permissions Summary
| AP[7:6] | EL1 (kernel) | EL0 (user) |
|---|---|---|
| 00 | Read/Write | No access |
| 01 | Read/Write | Read/Write |
| 10 | Read-only | No access |
| 11 | Read-only | Read-only |
XNU Virtual Memory Subsystem
VM Map
// vm_map = address space representation
struct vm_map {
struct vm_map_header hdr; // Sorted list of vm_map_entry
pmap_t pmap; // Machine-dependent page tables
vm_map_size_t size; // Virtual size
// ...
};
// vm_map_entry = one contiguous mapping
struct vm_map_entry {
struct vm_map_entry *prev, *next; // Doubly-linked list
vm_map_offset_t vme_start; // Start virtual address
vm_map_offset_t vme_end; // End virtual address
vm_prot_t protection; // Current protection
vm_prot_t max_protection; // Maximum allowed protection
// ...
union {
vm_object_t vme_object; // Backing object (file, anonymous)
};
};
Pmap (Physical Map)
// pmap = machine-dependent page table management
struct pmap {
tt_entry_t *tte; // Top-level page table pointer
uint64_t asid; // Address Space ID (for TLB)
// ...
};
Key pmap functions:
// Create mapping: virtual → physical
pmap_enter_options(pmap, va, pa, prot, fault_type, flags, options);
// Remove mapping
pmap_remove(pmap, start, end);
// Change protection
pmap_protect(pmap, start, end, prot);
// Query mapping
pmap_find_phys(pmap, va); // Returns physical page number
TLB (Translation Lookaside Buffer)
TLB = cache for page table entries. The CPU does not walk page tables on every memory access – it checks the TLB first.
CPU needs virtual → physical translation
├─→ Check TLB (fast path)
│ ├─→ TLB hit: use cached translation
│ └─→ TLB miss: walk page tables (slow path)
│ └─→ Insert result into TLB
└─→ Access physical memory
TLB invalidation (TLBI instruction) is needed when:
- Page table entries are changed
- Context switch (ASID change)
Bug pattern: Kernel changes a PTE but forgets to invalidate TLB – stale translation is still used – security violation.
Physical Use-After-Free (PUAF)
Concept
1. Process A maps virtual address VA → physical page P
2. Bug: kernel frees physical page P but DOES NOT remove the mapping from process A's page tables
3. Kernel reallocates physical page P for another purpose (kernel object, page table, ...)
4. Process A still reads/writes P through VA → reads/writes kernel data!
PUAF → physrw Escalation
If page P becomes a Level 3 page table:
├─→ Process A writing to P = modifying page table entries
├─→ Create a new PTE pointing to ANY physical address
├─→ Map all of DRAM into the address space
└─→ Full physical read/write!
If page P becomes a kernel object:
├─→ Process A writing to P = corrupting a kernel object
└─→ Escalate to kread/kwrite
Defenses (iOS 17+ SPTM)
SPTM ensures:
- Physical pages track their "type" (user, kernel, page table, ...)
- User pages CANNOT be reallocated as kernel pages until next boot
- Page table modifications MUST go through SPTM (EL2)
→ PUAF from user → kernel is blocked
→ PUAF user → user still possible (less useful)
Page Lifecycle
Free page pool
│
├─ vm_page_grab() → Allocate physical page
│ └─ pmap_enter() → Map into address space
│
├─ pmap_remove() → Remove mapping
│ └─ vm_page_free() → Return to free pool
│
└─ PUAF bug: vm_page_free() WITHOUT pmap_remove()
→ Page returned to free pool but still mapped!
Kernel Memory Regions
┌─────────────────────────────────────────┐
│ Kernel Virtual Address Space │
│ │
│ ┌─────────────────────┐ │
│ │ Kernelcache │ Fixed mapping │
│ │ (__TEXT, __DATA) │ KASLR slide │
│ └─────────────────────┘ │
│ ┌─────────────────────┐ │
│ │ Zone maps │ Dynamic │
│ │ (kalloc, ipc, ...) │ │
│ └─────────────────────┘ │
│ ┌─────────────────────┐ │
│ │ Kernel map │ General │
│ │ (large allocations) │ purpose │
│ └─────────────────────┘ │
│ ┌─────────────────────┐ │
│ │ MMIO regions │ Device │
│ │ (hardware registers)│ mappings │
│ └─────────────────────┘ │
└─────────────────────────────────────────┘
Resources
- XNU source:
osfmk/vm/vm_map.c,osfmk/arm64/pmap.c - Apple – Memory and Virtual Memory
- Project Zero – The Core of Apple is PPL
- Alfie CG – Kernel Exploit Guide (VM exploitation sections)
- ARM Architecture Reference Manual – Chapter D5 (Address Translation)
Exercises
- Manual page table walk: Given a virtual address, TTBR value, and page table dumps – compute the physical address by hand
- Read pmap.c: Trace
pmap_enter_options()– understand what each parameter does - Analyze a PUAF exploit: Read the kfd source code, trace the PUAF primitive (smith/landa/physpuppet)
- Draw a memory map: For a running process, use
vmmap(macOS) to draw the full address space layout - Compute PTE values: Given a physical address + desired permissions, construct the PTE value by hand