Probably an M2 vulnerability too?
MIT researchers uncover ‘unpatchable’ flaw in Apple M1 chips
101–110 of 204 posts
Re: MIT researchers uncover ‘unpatchable’ flaw in Apple M1 chips
#102ummm. Could this flaw be attacked via the web? And Apple cannot fix it?
Re: MIT researchers uncover ‘unpatchable’ flaw in Apple M1 chips
#103Earlier quoted context omitted.
Welcome to journalism.
It’s not just a problem with journalism but with humans in general. People are more imprecise with their comprehension of things than they are willing to admit.
Thank you. Even here on HN, plenty of folks will comment on all kinds of research they know little about.
Re: MIT researchers uncover ‘unpatchable’ flaw in Apple M1 chips
#104Considering all we have learned over the years, it is not unreasonable to wonder whether this “flaw” isn’t there by design to meet some secret American government vulnerability requirement.
The NSA is holding a portfolio of undiscovered vulnerabilities, whether they've been planted by its operatives or discovered by its researchers. Old ones get discovered independently and patched, new ones get created, all the time.
Sending men in black or a top secret letter to a company and demanding a back door has to be the clumsiest possible way to go about introducing a vulnerability. It creates way too many people in the know, anyone could disclose it to researchers like OP who could then claim to have found it independently.
It's way more effective to have moles on your payroll.
Re: MIT researchers uncover ‘unpatchable’ flaw in Apple M1 chips
#105Re: MIT researchers uncover ‘unpatchable’ flaw in Apple M1 chips
#106Earlier quoted context omitted.
Hi! I think I can clear a few things up here. Our goal is to demonstrate that we can learn the PAC for a kernel pointer from userspace. Just demonstrating that this is even possible is a big step in understanding of how mitigations like pointer authentication can be thought of in the spectre era. We do not aim to be a zero day, but instead aim to be a way of thinking about attacks/ an attack methodology. The timer us…
Something definitely went wrong here though that more guidance was not provided to the tech journalists. Most of the mainstream articles make it seem like they a) did not read the paper b) are incapable of understanding the paper c) were not provided any guidance about what any of this actually means in the real world. Which is all scary as the paper is well written and very accessible IMO.
Based on the article, I think the journalist basically understands the situation (and if they don't, they should investigate further, that's the job). The headline is just intentionally over-dramatic to get clicks. This shouldn't be treated as a good-faith error, more guidance isn't required and wouldn't help.
Re: MIT researchers uncover ‘unpatchable’ flaw in Apple M1 chips
#107My reading implies you need actual code execution already? As you need to be able lay down the actual auth instruction that you want to force? (Eg nothing so horrific as simply running js)
Hahah, ok now I have a much better understanding.
It requires an existing path to arbitrary code execution, and a buffer overflow or some such in kernel space.
So yes this does defeat one part of the M1 defensive system, which is clearly suboptimal, but the way the article portrays it is absurd.
Re: MIT researchers uncover ‘unpatchable’ flaw in Apple M1 chips
#108Earlier quoted context omitted.
For the uninitiated, are such ‘unpatchable’ hardware flaws prevalent and/or debilitating to a greater or lesser degree in other processors (Intel, AMD, Apple AX processors)? Or has Apple "dropped the ball" compared with other chip designers?
You can look up some other major events such as spectre/meltdown which also used hardware side channels and speculative execution, or rowhammer which affects RAM.
Interesting! Were the unit testing procedures used in the hardware design and simulation processes themselves flawed? Reading up on these I have not yet been able to elucidate any forensic insight into the original chip design.
Re: MIT researchers uncover ‘unpatchable’ flaw in Apple M1 chips
#109Related:
https://spectrum.ieee.org/pacman-hack-can-break-apple-m1s-la...
(via https://news.ycombinator.com/item?id=31694844 and https://news.ycombinator.com/item?id=31694017, but we merged the latter hither and the former had no comments)
Re: MIT researchers uncover ‘unpatchable’ flaw in Apple M1 chips
#110I wonder at what point we will finally give up on trying to make a stable implementation of speculative execution.
[deleted]