Kernel memory-protection bypass via RTKit out-of-bounds write

Memory corruption in RTKit across Apple operating systems allows local users with kernel read and write capability to bypass memory protections. RTKit insufficiently validates data used for a memory write, permitting an out-of-bounds write that corrupts protected kernel state. Exploitation requires prior arbitrary kernel read and write capability, so the flaw is a follow-on bypass rather than initial access; exploitation has been reported.