The Apple PCIe Message Ring protocol suffers from multiple race conditions that can lead to out-of-bounds read and writes.
9d829639573f82bd62beacc1312bfa32eb067d298b7f05c51fa7d65065d918c1
Apple Security Advisory 2017-09-20-3 - tvOS 11 addresses code execution vulnerabilities.
15a3c1f5437e40580d8e005ab73b5fa1f21710b492e652da0283bb117e57a3dc
Apple Security Advisory 2017-09-20-1 - This advisory provides additional information for APPLE-SA-2017-09-19-1 iOS 11.
8aeb5a27b696a6b9371d6de6e28fa2fbc84fc7b2623227bae3da19122efca2d6