Since the M1 is not being used in servers, how big of a deal is this?
MIT researchers uncover ‘unpatchable’ flaw in Apple M1 chips
81–90 of 204 posts
Re: MIT researchers uncover ‘unpatchable’ flaw in Apple M1 chips
#82Earlier quoted context omitted.
They probably won't care about this, although I do find it weird when researchers make a whole website with custom domain just to publish something like this. Personally, it comes off as less trustworthy since it enters the same realm of bullshit as those market manipulation attacks on AMD a few years back[1] Not saying that's what this is (I'm sure these are legitimate findings), but this tactic raises some red flag…
Yeah I hate this trend of naming vulnerabilities and pandering to the tech press. The CTS Labs FUD was just beyond the pale. Most tech journalism just ate up those claims that were clearly B.S. and not even self consistent. They were claiming it was impossible for AMD to patch with firmware or microcode but in the same sentence claiming an attacker could use it to create a rootkit that couldn't be removed. Nobody bot…
>Yeah I hate this trend of naming vulnerabilities and pandering to the tech press.
It is not a trend. It's a tradition:
Back Orifice. Ping of Death. Smurf Attack. Computer Viruses. Computer Worms. (Hello Robert Morris!)
Re: MIT researchers uncover ‘unpatchable’ flaw in Apple M1 chips
#83The author is here and ought to make it all clear but if you google the title of the article you can download the paper already despite everyone being coy about it and the ACM not having published it yet. It's kind of ridiculous it's getting this kind of press before the paper is officially published and available. If the paper was published and security experts were allowed to analyze it before the tech press went n…
Installing a kext is a password prompt away, I believe, so all that's needed technically seems to be "install something not reviewed by Apple, fill in a genuine OS password prompt when asked, and run it" which strikes me as a very common scenario.
Enabling 3rd-party extensions is much more involved on AS Macs: https://support.apple.com/guide/mac-help/change-security-set...
Then the extension needs to be allowed in System Preferences > Security (this step has been required on Intel Macs too)
Re: MIT researchers uncover ‘unpatchable’ flaw in Apple M1 chips
#84Earlier quoted context omitted.
Installing a kext is a password prompt away, I believe, so all that's needed technically seems to be "install something not reviewed by Apple, fill in a genuine OS password prompt when asked, and run it" which strikes me as a very common scenario.
Enabling 3rd-party extensions is much more involved on AS Macs: https://support.apple.com/guide/mac-help/change-security-set... Then the extension needs to be allowed in System Preferences > Security (this step has been required on Intel Macs too)
Additionally, if can find a way to trick a user into installing a malicious kext, why even bother with PACMAN? You already have arbitrary kernel code execution!
Re: MIT researchers uncover ‘unpatchable’ flaw in Apple M1 chips
#85The growing pains of silicon development date back to the Intel line of Pentium FDIV bug issues. Not surprised it occurred, just surprised it took so long to come to fruition. I can only think its the lack of hardware engineers savvy enough to exploit such an issue, since the abstractions from hardware are so far removed from us general populous software developers. Any thoughts on the above?
For the uninitiated, are such ‘unpatchable’ hardware flaws prevalent and/or debilitating to a greater or lesser degree in other processors (Intel, AMD, Apple AX processors)? Or has Apple "dropped the ball" compared with other chip designers?
Re: MIT researchers uncover ‘unpatchable’ flaw in Apple M1 chips
#86Earlier quoted context omitted.
Yes, it’s defined by ARM. Though the unsafe implementation of speculative execution is obviously by Apple.
Is Apple's implementation the only vulnerable implementation? Prior speculative execution issues applied to more than one vendor's implementation.
Except for the Apple CPUs, only the ARM cores introduced in 2021 implement this.
It remains to be seen whether their implementation is better.
Until now only few people had access to such recent CPUs, which can be found only in the 2022 models of some smartphones and in the new Graviton 3 servers, so they did not receive much scrutiny.
Re: MIT researchers uncover ‘unpatchable’ flaw in Apple M1 chips
#87The author is here and ought to make it all clear but if you google the title of the article you can download the paper already despite everyone being coy about it and the ACM not having published it yet. It's kind of ridiculous it's getting this kind of press before the paper is officially published and available. If the paper was published and security experts were allowed to analyze it before the tech press went n…
> "PACMAN is an exploitation technique- on its own it cannot compromise your system. While the hardware mechanisms used by PACMAN cannot be patched with software features, memory corruption bugs can be."
reading the "official" site of the Researchers gives more clues than the headline of the article.
Re: MIT researchers uncover ‘unpatchable’ flaw in Apple M1 chips
#88Earlier quoted context omitted.
Something definitely went wrong here though that more guidance was not provided to the tech journalists. Most of the mainstream articles make it seem like they a) did not read the paper b) are incapable of understanding the paper c) were not provided any guidance about what any of this actually means in the real world. Which is all scary as the paper is well written and very accessible IMO.
Welcome to tech journalism.
Welcome to journalism.
Re: MIT researchers uncover ‘unpatchable’ flaw in Apple M1 chips
#89Earlier quoted context omitted.
Having grokked the abstract, I feel like can speculate a bit as to what is going on. Take this with a grain of salt; I have no clue what has actually been discovered. I believe that the researchers have found a way to remove PAC as a barrier to exploitation by disclosing PAC verification results via speculative execution. This is only useful to attackers going after a target that uses PAC, and those attackers will ne…
You hit the nail right on the head! That's exactly what we did :)
Apparently they haven’t fixed it yet, so a hardware solution may in fact not be possible, but is there any reason to believe it couldn’t be patched in “microcode”?
Who can guess at the performance impact, but one could imagine a configurable mechanism capable of disabling speculation past a PAC authentication.
Re: MIT researchers uncover ‘unpatchable’ flaw in Apple M1 chips
#90The author is here and ought to make it all clear but if you google the title of the article you can download the paper already despite everyone being coy about it and the ACM not having published it yet. It's kind of ridiculous it's getting this kind of press before the paper is officially published and available. If the paper was published and security experts were allowed to analyze it before the tech press went n…
Also important to mention that PAC is a new ARMv8.2 feature and previous versions of ARM have no PAC system at all. The only ARM chips with PAC are from Apple and AWS Graviton3 - any other chip has no hardware protections against this. So ultimately, right now, it's just downgrading a very new protection to as if it didn't exist, which is exactly how 98% of ARM chips in the world operate right now. Not great, not ter…
Edit: Correction, ARMv8.3, not ARMv8.2.