171–180 of 204 posts
Earlier quoted context omitted.
You hit the nail right on the head! That's exactly what we did :)
Apparently they haven’t fixed it yet, so a hardware solution may in fact not be possible, but is there any reason to believe it couldn’t be patched in “microcode”? Who can guess at the performance impact, but one could imagine a configurable mechanism capable of disabling speculation past a PAC authentication.
Earlier quoted context omitted.
Interesting! Were the unit testing procedures used in the hardware design and simulation processes themselves flawed? Reading up on these I have not yet been able to elucidate any forensic insight into the original chip design.
Unit testing isn't really the issue here, spectre / meltdown / rowhammer are pretty fundamental design problems.
Hi! Joseph (one of the authors) here. You can read more about our attack here: https://pacmanattack.com
A colleague pointed out that FPAC[1] in ARMV8.6-A likely prevents this attack, is that right?
I haven't fully digested the paper, but the gadgets seem to rely on AUT, and "Implementations with FPAC generate an exception on an AUT* instruction where the PAC is incorrect"
[1] https://community.arm.com/arm-community-blogs/b/architecture...
Earlier quoted context omitted.
Apparently they haven’t fixed it yet, so a hardware solution may in fact not be possible, but is there any reason to believe it couldn’t be patched in “microcode”? Who can guess at the performance impact, but one could imagine a configurable mechanism capable of disabling speculation past a PAC authentication.
Does the m1 even have microcode ?
Earlier quoted context omitted.
It's sad that we reached a point where assuming bad faith from public informers is acceptable and, worse, reasonable.
Worth noting that someone else usually writes the headline for the articles, not the journalist / the author of an article.
Earlier quoted context omitted.
Worth noting that someone else usually writes the headline for the articles, not the journalist / the author of an article.
OK, but that doesn't excuse things. There's a problem with journalism and its mostly about how they are incentivized and compensated. I don't know what the fix is but its clear that trust is so low, and rightfully so that journalism has largely failed as an industry at its job.
Earlier quoted context omitted.
Enabling 3rd-party extensions is much more involved on AS Macs: https://support.apple.com/guide/mac-help/change-security-set... Then the extension needs to be allowed in System Preferences > Security (this step has been required on Intel Macs too)
Additionally, if can find a way to trick a user into installing a malicious kext, why even bother with PACMAN? You already have arbitrary kernel code execution!