When user closes a handle of AppleHVClient the kernel will call AppleHVClient::free via IOService::terminateWorker, and this free function will call hv_vmx_vm_t::free as follow.
hv_vmx_vm_t::free function will fetch the lock and free this lock. But at the same time, user can use this lock via machdep system call hv_vmx_vm_t::TRAP_hv_destroy_vm.
So UaF happens. Details about this issue and some basic knowledges about XNU which powers iOS/macOS are discussed in the complete write-up.
And PoC of this issue is also available on Github.
There exists an integer overflow in kqueue syscall which can lead to kernel deadlock(Or crash on some devices) on latest macOS and iOS. kqueue in BSD is just like epoll in Linux which powers IO multiplexing. It means users can monitor a set of actions of file descriptors, like read or write available. At the same time, an object of kqueue in kernel is also a file descriptor in user space, so users can monitor a file descriptor of kqueue object by kqueue. The kqueues which monitor other objects are called parent kqueue, so we can name the kqueue to be monitored as child kqueue, it is fine until now because they are both file descriptors. The problem is that the user can make a circular kqueue which means the two kqueues can monitor each other.
Lets look at the source. The function associated with this issue lies in bsd/kern/kern_event.c named kqueue_kqfilter. This function is called when the child kqueue is attached to the list of parent kqueue. This is a piece of comment in this function.
* passes, we just mark the nesting levels accordingly.
It seems fine because the level of child will always be lower than the parent. But the level field of kqueue is just a 16 bit unsigned integer which means we can overflow it easily.
*          derived from this definition.
Line 16 is the root cause of this integer overflow. When the kq->kq_level is 65535 and parentkq->kq_level is 2(Changed to 2 when it is 0), the parentkq->kq_level will be set to 0. When we do this in the opposite way, it can bypass the condition of the if statement.
After that you can see a kernel crash or kernel deadlock.
This poc is also worked on my iOS 11.0.2 of iPhone 8 Plus, I believe it can also work on latest iOS 11.2.5.
Update on July 5, 2018: This issue still exists on latest macOS 10.13.5 and iOS 11.4.
To Be Four Haves Youth.