Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

MIT researchers uncover ‘unpatchable’ flaw in Apple M1 chips

techcrunch.com

Post reply on HN
Print view View original

91–100 of 204 posts

Re: MIT researchers uncover ‘unpatchable’ flaw in Apple M1 chips

#91

Post by opheliate »

azinman2 wrote: post #72
ben7799 wrote: post #54

Earlier quoted context omitted.

Something definitely went wrong here though that more guidance was not provided to the tech journalists. Most of the mainstream articles make it seem like they a) did not read the paper b) are incapable of understanding the paper c) were not provided any guidance about what any of this actually means in the real world. Which is all scary as the paper is well written and very accessible IMO.

Welcome to tech journalism.

Just tech journalism? :) https://en.wikipedia.org/wiki/Michael_Crichton#GellMannAmnes...

Re: MIT researchers uncover ‘unpatchable’ flaw in Apple M1 chips

#92

Post by nostrebored »

KennyBlanken wrote: post #80
jprx wrote: post #39

Earlier quoted context omitted.

Hi! I think I can clear a few things up here. Our goal is to demonstrate that we can learn the PAC for a kernel pointer from userspace. Just demonstrating that this is even possible is a big step in understanding of how mitigations like pointer authentication can be thought of in the spectre era. We do not aim to be a zero day, but instead aim to be a way of thinking about attacks/ an attack methodology. The timer us…

You didn't clear up anything about publicizing this heavily in mainstream press before it's been reviewed by your peers.

What are you hoping for here? Look at the facts as written.

Re: MIT researchers uncover ‘unpatchable’ flaw in Apple M1 chips

#94

Post by sizzle »

ENOTTY wrote: post #21
ENOTTY wrote: post #8

As someone with a bit of experience in this area, IMO, the Techcrunch article is more confusing than it should be. Here's a link to the actual abstract. The work will be presented at ISCA, which will start on June 18. https://dl.acm.org/doi/10.1145/3470496.3527429 Here's a link to MIT's press release. https://www.csail.mit.edu/news/researchers-discover-new-hard... Here's a link to the vulnerability's website, as is t…

Having grokked the abstract, I feel like can speculate a bit as to what is going on. Take this with a grain of salt; I have no clue what has actually been discovered. I believe that the researchers have found a way to remove PAC as a barrier to exploitation by disclosing PAC verification results via speculative execution. This is only useful to attackers going after a target that uses PAC, and those attackers will ne…

Amazingly articulate writing, I think you have a second career as a tech writer if you ever wanted

Re: MIT researchers uncover ‘unpatchable’ flaw in Apple M1 chips

#95

Post by adrian_b »

gjsman-1000 wrote: post #38
ben7799 wrote: post #34

The author is here and ought to make it all clear but if you google the title of the article you can download the paper already despite everyone being coy about it and the ACM not having published it yet. It's kind of ridiculous it's getting this kind of press before the paper is officially published and available. If the paper was published and security experts were allowed to analyze it before the tech press went n…

Also important to mention that PAC is a new ARMv8.2 feature and previous versions of ARM have no PAC system at all. The only ARM chips with PAC are from Apple and AWS Graviton3 - any other chip has no hardware protections against this. So ultimately, right now, it's just downgrading a very new protection to as if it didn't exist, which is exactly how 98% of ARM chips in the world operate right now. Not great, not ter…

Besides the Apple CPUs and Graviton 3 (Armv8.4-A), the cores introduced by ARM in 2021 and present in some 2022 smartphones (Cortex-X2, Cortex-A710, Cortex-A510), which implement Armv9.0-A, also support PAC.

Re: MIT researchers uncover ‘unpatchable’ flaw in Apple M1 chips

#97

Post by marcosdumay »

ben7799 wrote: post #54
jprx wrote: post #39

Earlier quoted context omitted.

Hi! I think I can clear a few things up here. Our goal is to demonstrate that we can learn the PAC for a kernel pointer from userspace. Just demonstrating that this is even possible is a big step in understanding of how mitigations like pointer authentication can be thought of in the spectre era. We do not aim to be a zero day, but instead aim to be a way of thinking about attacks/ an attack methodology. The timer us…

Something definitely went wrong here though that more guidance was not provided to the tech journalists. Most of the mainstream articles make it seem like they a) did not read the paper b) are incapable of understanding the paper c) were not provided any guidance about what any of this actually means in the real world. Which is all scary as the paper is well written and very accessible IMO.

a) did not read the paper

Yeah, that's a given. Journalists do not have time for optional tasks.

b) are incapable of understanding the paper

That's a safe bet.

c) were not provided any guidance

Asking for guidance or clarifications is another one of those optional tasks.

Re: MIT researchers uncover ‘unpatchable’ flaw in Apple M1 chips

#98

Post by throwaway290 »

jprx wrote: post #84
bhj wrote: post #83

Earlier quoted context omitted.

Enabling 3rd-party extensions is much more involved on AS Macs: https://support.apple.com/guide/mac-help/change-security-set... Then the extension needs to be allowed in System Preferences > Security (this step has been required on Intel Macs too)

Additionally, if can find a way to trick a user into installing a malicious kext, why even bother with PACMAN? You already have arbitrary kernel code execution!

Perhaps the kext with the overflow may not necessarily look malicious? It can serve as an actually useful kext and pass review.

Re: MIT researchers uncover ‘unpatchable’ flaw in Apple M1 chips

#99

Post by rTX5CMRXIfFG »

sirspacey wrote: post #88
azinman2 wrote: post #72

Earlier quoted context omitted.

Welcome to tech journalism.

Welcome to journalism.

It’s not just a problem with journalism but with humans in general. People are more imprecise with their comprehension of things than they are willing to admit.

Re: MIT researchers uncover ‘unpatchable’ flaw in Apple M1 chips

#100

Post by depereo »

stevenjgarner wrote: post #85
BLO716 wrote: post #71

The growing pains of silicon development date back to the Intel line of Pentium FDIV bug issues. Not surprised it occurred, just surprised it took so long to come to fruition. I can only think its the lack of hardware engineers savvy enough to exploit such an issue, since the abstractions from hardware are so far removed from us general populous software developers. Any thoughts on the above?

For the uninitiated, are such ‘unpatchable’ hardware flaws prevalent and/or debilitating to a greater or lesser degree in other processors (Intel, AMD, Apple AX processors)? Or has Apple "dropped the ball" compared with other chip designers?

You can look up some other major events such as spectre/meltdown which also used hardware side channels and speculative execution, or rowhammer which affects RAM.
Post reply on HN