Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

MIT researchers uncover ‘unpatchable’ flaw in Apple M1 chips

techcrunch.com

Post reply on HN
Print view View original

141–150 of 204 posts

Re: MIT researchers uncover ‘unpatchable’ flaw in Apple M1 chips

#141

Post by saagarjha »

Findecanor wrote: post #114
Mo3 wrote: post #33

Earlier quoted context omitted.

And this can really not be fixed in any way? Not trolling, happy to barely understand this in the first place

Until it has been fixed in hardware I think it could be mitigated in software a bit, but at a cost. A PAC signature can include also a 64-bit "context" value, which you could make unique per pointer (like a nonce). However, context values are not something that is supported by any C ABI: the PAC extension contains also instructions that hardcode the context value to zero, and I would guess that those are what the ker…

C pointers don’t typically use the context very much, but C++ uses it heavily.

Re: MIT researchers uncover ‘unpatchable’ flaw in Apple M1 chips

#142

Post by saagarjha »

pizlonator wrote: post #75

So an attacker who needs to bypass PAC can already sometimes find a nonspeculative PAC bypass, though it’s hard. Assuming they can’t, maybe they can use this, if they can find and weaponize an appropriate gadget in the kernel. Sounds plausible but hard; maybe harder than finding a nonspeculative PAC bypass. Any speculative PAC bypass will also suffer from nondeterminism, so it’s not as practical for an attacker as a…

One “feature” this has is that, assuming no retpoline-like mitigation is constructed to prevent against it, it’s usable for a long time if you can get it to work: at least as long as the gadget remains and conditions remain favorable. Your favorite non-speculative PAC bypass might get patched in the next iOS release and you’re back at square one.

Re: MIT researchers uncover ‘unpatchable’ flaw in Apple M1 chips

#144

Post by saagarjha »

userbinator wrote: post #131
cosmiccatnap wrote: post #10

I wonder at what point we will finally give up on trying to make a stable implementation of speculative execution.

I wonder at what point we will finally give up on all these "mitigations" which are otherwise pure bloat without the presence of an actual attack, and seem like they don't make things all that much harder even when there is one.

PAC is a good mitigation with a good threat model: preventing ROP/JOP.

Re: MIT researchers uncover ‘unpatchable’ flaw in Apple M1 chips

#145

Post by pizlonator »

saagarjha wrote: post #142
pizlonator wrote: post #75

So an attacker who needs to bypass PAC can already sometimes find a nonspeculative PAC bypass, though it’s hard. Assuming they can’t, maybe they can use this, if they can find and weaponize an appropriate gadget in the kernel. Sounds plausible but hard; maybe harder than finding a nonspeculative PAC bypass. Any speculative PAC bypass will also suffer from nondeterminism, so it’s not as practical for an attacker as a…

One “feature” this has is that, assuming no retpoline-like mitigation is constructed to prevent against it, it’s usable for a long time if you can get it to work: at least as long as the gadget remains and conditions remain favorable. Your favorite non-speculative PAC bypass might get patched in the next iOS release and you’re back at square one.

Agreed.

Re: MIT researchers uncover ‘unpatchable’ flaw in Apple M1 chips

#146

Post by ENOTTY »

sizzle wrote: post #94
ENOTTY wrote: post #21

Earlier quoted context omitted.

Having grokked the abstract, I feel like can speculate a bit as to what is going on. Take this with a grain of salt; I have no clue what has actually been discovered. I believe that the researchers have found a way to remove PAC as a barrier to exploitation by disclosing PAC verification results via speculative execution. This is only useful to attackers going after a target that uses PAC, and those attackers will ne…

Amazingly articulate writing, I think you have a second career as a tech writer if you ever wanted

Hahaha thank you. I am humbled by your praise

Re: MIT researchers uncover ‘unpatchable’ flaw in Apple M1 chips

#147

Post by joebob42 »

stevenjgarner wrote: post #108
depereo wrote: post #100

Earlier quoted context omitted.

You can look up some other major events such as spectre/meltdown which also used hardware side channels and speculative execution, or rowhammer which affects RAM.

Interesting! Were the unit testing procedures used in the hardware design and simulation processes themselves flawed? Reading up on these I have not yet been able to elucidate any forensic insight into the original chip design.

Unit testing isn't really the issue here, spectre / meltdown / rowhammer are pretty fundamental design problems.

Re: MIT researchers uncover ‘unpatchable’ flaw in Apple M1 chips

#148

Post by WuxiFingerHold »

ben7799 wrote: post #34

The author is here and ought to make it all clear but if you google the title of the article you can download the paper already despite everyone being coy about it and the ACM not having published it yet. It's kind of ridiculous it's getting this kind of press before the paper is officially published and available. If the paper was published and security experts were allowed to analyze it before the tech press went n…

> - Login to the Mac in question

Really? Usually malicious stuff is installed by the user themselves being unaware of it.

Re: MIT researchers uncover ‘unpatchable’ flaw in Apple M1 chips

#149

Post by reed1234 »

serf wrote: post #116

> https://pacmanattack.com >does PACMAN have a logo? >Yes! great, answering the hard questions. the trend of creating a marketing website for every horrible exploit is so strange. Who are these people selling to, and what? Fear to media outlets is my only guess.

Researchers write papers. They want their papers to be read by many people as they depend on them for their livelihood. Wouldn’t you market yours?

Re: MIT researchers uncover ‘unpatchable’ flaw in Apple M1 chips

#150

Post by [deleted] »

d4v3 wrote: post #122
JohnJamesRambo wrote: post #119

Earlier quoted context omitted.

Any thread about nutrition is so painful here.

Anything related to medicine/biochemistry can get cringe-y pretty quickly here. I think the problem is that the crowd here is generally pretty intelligent, but they know it and it's a coefficient > 1 on the Dunning-Kruger effect

[deleted]
Post reply on HN