news.volyx.in

MIT researchers uncover ‘unpatchable’ flaw in Apple M1 chips (techcrunch.com)

885 points by markus_zhang · 1555 days ago · 194 comments on HN

Article summary

MIT researchers have discovered a hardware vulnerability in Apple's M1 chips, which could allow attackers to break through the chip's last line of security defenses. The vulnerability, called Pacman, exploits a hardware-level security mechanism called pointer authentication codes. This attack can defeat the security feature without leaving a trace, and as it utilizes a hardware mechanism, no software patch can fix it. The researchers have demonstrated that the attack works against the kernel, which has significant implications for future security work on all ARM systems with pointer authentication enabled.

Main themes

  • Apple M1 chip vulnerability
  • Pacman attack
  • Speculative execution security risks
  • Pointer authentication codes
  • Hardware vs software mitigation
  • Performance vs security tradeoffs
  • ARM system security implications

What commenters say

  • The Pacman attack is a significant security flaw, but it requires existing code execution and is not a magic bypass for all security on the M1 chip.
  • The vulnerability is not a major concern for most users, as it is a mitigation that applies when other security measures have already failed.
  • Speculative execution is a root cause of the problem and its benefits may not outweigh its security risks.
  • The attack can be mitigated in software, but at a cost, and a hardware solution may be necessary to fully fix the issue.
  • The use of pointer authentication codes is not a reliable security feature due to its small hash size and the possibility of bruteforcing the hash.
  • Disabling speculative execution or using specialized hardware without speculative execution could be a potential solution to prevent similar attacks.
  • The performance gain from speculative execution may not be worth the security risks it poses.
  • A potential mitigation could be to rotate the key used in the PAC algorithm, but this may not be practical due to the need to maintain compatibility with existing pointers.