Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

MIT researchers uncover ‘unpatchable’ flaw in Apple M1 chips

techcrunch.com

Post reply on HN
Print view View original

111–120 of 204 posts

Re: MIT researchers uncover ‘unpatchable’ flaw in Apple M1 chips

#111

Post by jazzyjackson »

ben7799 wrote: post #54
jprx wrote: post #39

Earlier quoted context omitted.

Hi! I think I can clear a few things up here. Our goal is to demonstrate that we can learn the PAC for a kernel pointer from userspace. Just demonstrating that this is even possible is a big step in understanding of how mitigations like pointer authentication can be thought of in the spectre era. We do not aim to be a zero day, but instead aim to be a way of thinking about attacks/ an attack methodology. The timer us…

Something definitely went wrong here though that more guidance was not provided to the tech journalists. Most of the mainstream articles make it seem like they a) did not read the paper b) are incapable of understanding the paper c) were not provided any guidance about what any of this actually means in the real world. Which is all scary as the paper is well written and very accessible IMO.

d) were given about 90 minutes to write the article

Re: MIT researchers uncover ‘unpatchable’ flaw in Apple M1 chips

#112

Post by pineconewarrior »

formvoltron wrote: post #102

ummm. Could this flaw be attacked via the web? And Apple cannot fix it?

No, not without several other 0-days to exploit. See the other comments here.

Essentially, the attacker must have access to another buffer overflow of some sort.

This is only a bypass for a specific line of defense, called PAC - a security feature introduced recently in ARM 8.3. By itself, it is not enough to attack a system at all.

Re: MIT researchers uncover ‘unpatchable’ flaw in Apple M1 chips

#114

Post by Findecanor »

Mo3 wrote: post #33
ENOTTY wrote: post #21

Earlier quoted context omitted.

Having grokked the abstract, I feel like can speculate a bit as to what is going on. Take this with a grain of salt; I have no clue what has actually been discovered. I believe that the researchers have found a way to remove PAC as a barrier to exploitation by disclosing PAC verification results via speculative execution. This is only useful to attackers going after a target that uses PAC, and those attackers will ne…

And this can really not be fixed in any way? Not trolling, happy to barely understand this in the first place

Until it has been fixed in hardware I think it could be mitigated in software a bit, but at a cost. A PAC signature can include also a 64-bit "context" value, which you could make unique per pointer (like a nonce).

However, context values are not something that is supported by any C ABI: the PAC extension contains also instructions that hardcode the context value to zero, and I would guess that those are what the kernel is using currently. To make use of context values, I suppose you would have to use a new ABI that stores effectively 128-bit pointers, and which also creates the random nonces/keys/whatyoucallthem to store in them.

Re: MIT researchers uncover ‘unpatchable’ flaw in Apple M1 chips

#116

Post by serf »

>https://pacmanattack.com

>does PACMAN have a logo? >Yes!

great, answering the hard questions.

the trend of creating a marketing website for every horrible exploit is so strange. Who are these people selling to, and what?

Fear to media outlets is my only guess.

Re: MIT researchers uncover ‘unpatchable’ flaw in Apple M1 chips

#117

Post by TrevorJ »

ben7799 wrote: post #54
jprx wrote: post #39

Earlier quoted context omitted.

Hi! I think I can clear a few things up here. Our goal is to demonstrate that we can learn the PAC for a kernel pointer from userspace. Just demonstrating that this is even possible is a big step in understanding of how mitigations like pointer authentication can be thought of in the spectre era. We do not aim to be a zero day, but instead aim to be a way of thinking about attacks/ an attack methodology. The timer us…

Something definitely went wrong here though that more guidance was not provided to the tech journalists. Most of the mainstream articles make it seem like they a) did not read the paper b) are incapable of understanding the paper c) were not provided any guidance about what any of this actually means in the real world. Which is all scary as the paper is well written and very accessible IMO.

>Most of the mainstream articles make it seem like they a) did not read the paper b) are incapable of understanding the paper

This seems pretty par for the course in terms of science/tech journalism to be honest.

Re: MIT researchers uncover ‘unpatchable’ flaw in Apple M1 chips

#118

Post by pjscott »

serf wrote: post #116

> https://pacmanattack.com >does PACMAN have a logo? >Yes! great, answering the hard questions. the trend of creating a marketing website for every horrible exploit is so strange. Who are these people selling to, and what? Fear to media outlets is my only guess.

Imagine that you had come up with a delightfully clever way to break pointer authentication using wacky speculative execution side-channel shenanigans. Wouldn't you be proud? Wouldn't you want to give it a cute name and an explanatory web site and a picture of Pac-man in a Venn diagram? I sure would.

Re: MIT researchers uncover ‘unpatchable’ flaw in Apple M1 chips

#119

Post by JohnJamesRambo »

SantalBlush wrote: post #103
rTX5CMRXIfFG wrote: post #99

Earlier quoted context omitted.

It’s not just a problem with journalism but with humans in general. People are more imprecise with their comprehension of things than they are willing to admit.

Thank you. Even here on HN, plenty of folks will comment on all kinds of research they know little about.

Any thread about nutrition is so painful here.

Re: MIT researchers uncover ‘unpatchable’ flaw in Apple M1 chips

#120

Post by [deleted] »

SantalBlush wrote: post #103
rTX5CMRXIfFG wrote: post #99

Earlier quoted context omitted.

It’s not just a problem with journalism but with humans in general. People are more imprecise with their comprehension of things than they are willing to admit.

Thank you. Even here on HN, plenty of folks will comment on all kinds of research they know little about.

[deleted]
Post reply on HN