# CVE-2022-32917: AppleSPU out of bounds write

AppleSPU.kext ALLOCATE_BUFFER message lacks bounds check on a 16-entry buffer array, allowing kernel out-of-bounds write via IOUserClient.

- Payout: Real-world hack
- Severity: high
- Program: Apple iOS, MacOS
- Credited: Ned Williamson
- Disclosed: 2022-09-12
- CVE: CVE-2022-32917
- Write-up quality: 7/10
- Original: https://github.com/googleprojectzero/0days-in-the-wild/blob/main/0day-RCAs/2022/CVE-2022-32917.md
- Library page: https://bugbountylibrary.com/r/p0%3ACVE-2022-32917
- Tags: domain:desktop domain:oss impact:privesc kind:incident platform:project-zero sev:high tech:ios technique:fuzzing technique:source-review vuln:dos vuln:memory-corruption

**Target:** AppleSPU.kext kernel extension RTBuddy endpoint via IOUserClient
**Root cause:** AppleSPU::_asyncMessage ALLOCATE_BUFFER opcode 0x89 writes to buffer_entries[num_entries] without checking num_entries against the static array size of 16, causing an out-of-bounds write within the AppleSPU object.
**Steps:**
1. Open an IOUserClient to the AppleSPU RTBuddy endpoint.
2. Send ALLOCATE_BUFFER (opcode 0x89) messages repeatedly, each allocating a buffer and incrementing num_entries.
3. After 16 allocations, the 17th write lands past buffer_entries[16], overwriting adjacent fields (num_entries and beyond) in the AppleSPU struct.
**How found:** Author notes the bug is simple enough to be found by fuzzing or code auditing; fuzzing would need knowledge of message structure (seed corpus of valid AppleSPU messages, coverage feedback, or a grammar from manual analysis) to reach the ALLOCATE_BUFFER message type.
**Insight:** When auditing IOUserClient-exposed driver message handlers, look for statically-sized tracking arrays (e.g. buffer_entries[16]) paired with a counter incremented per message but never bounds-checked before indexing.