POINTER LEAKS THROUGH POINTER-KEYED DATA STRUCTURES

Summary from the TLDR InfoSec newsletter

Google Project Zero demonstrated a novel technique to remotely leak memory addresses without memory safety violations by exploiting pointer-keyed data structures in Apple's NSKeyedArchiver serialization. The attack works by crafting specific NSDictionary objects with carefully chosen NSNumber keys to control hash bucket placement, then using the serialized ordering of an NSNull singleton (whose hash is its memory address) to determine its location in the shared cache. While theoretical and requiring a deserialize-reserialize attack surface, this technique demonstrates how pointer-based hashing in keyed data structures can leak addresses even without timing attacks. Organizations should audit serialization endpoints and consider using keyed hash functions instead of raw pointer addresses for object hashing.