Apple M1 Chips Affected by Unpatchable "PACMAN" Exploit

[AleksandarK]

Apple M1 chips are a part of the Apple Silicon family that represents a new transition to Arm-based cores with new power and performance targets for Apple devices. A portion of building a processor is designing its security enclave, and today we have evidence that M1 processors got a new vulnerability. The PACMAN is a hardware attack that can bypass Pointer Authentication (PAC) on M1 processors. Security researchers took an existing concept of Spectre and its application in the x86 realm and now applied it to the Arm-based Apple silicon. PACMAN exploits a current software bug to perform pointer authentication bypass, which may lead to arbitrary code execution.

The vulnerability is a hardware/software co-design that exploits microarchitectural construction to execute arbitrary codes. PACMAN creates a PAC Oracle to check if a specific pointer matches its authentication. It must never crash if an incorrect guess is supplied and the attack brute-forces all the possible PAC values using the PAC Oracle. To suppress crashes, PAC Oracles are delivered speculatively. And to learn if the PAC value was correct, researchers used uArch side channeling. In the CPU resides translation lookaside buffers (TLBs), where PACMAN tries to load the pointer speculatively and verify success using the prime+probe technique. TLBs are filled with minimal addresses required to supply a particular TLB section. If any address is evicted from the TLB, it is likely a load success, and the bug can take over with a falsely authenticated memory address.



On the PACMAN website, you can see the attack in much greater detail and learn about it in-depth. It is important to note that Apple is aware of the issue, and researchers have been in talks with the company ever since 2021. Keeping the software up to date is mandatory, as these kinds of memory corruption bugs are patchable. The hardware part of this exploit is not patchable; however, users shouldn't be worried as it requires both software and hardware exploits to function.

View at TechPowerUp Main Site | Source

 

[ZoneDymo]

"The hardware part of this exploit is not patchable; however, users shouldn't be worried as it requires both software and hardware exploits to function."

So we start with some pathetic clickbait and end a bit more rational, good, now if we could just lay off the clickbait crap, youtube has (to my ever increasing disappointment) enough of it for the rest of the internet.

 

[zlobby]

Wakawakawakawakawaka.

 

[john_]

 

[DeathtoGnomes]

"The hardware part of this exploit is not patchable; however, users shouldn't be worried as it requires both software and hardware exploits to function."

So we start with some pathetic clickbait and end a bit more rational, good, now if we could just lay off the clickbait crap, youtube has (to my ever increasing disappointment) enough of it for the rest of the internet.

"Please click on our adds to support us"

 

[W1zzard]

"The hardware part of this exploit is not patchable; however, users shouldn't be worried as it requires both software and hardware exploits to function."

So we start with some pathetic clickbait and end a bit more rational, good, now if we could just lay off the clickbait crap, youtube has (to my ever increasing disappointment) enough of it for the rest of the internet.

You did check their paper? "Hardware" doesn't mean "physical access"

Does this attack require physical access?
Nope! We actually did all our experiments over the network on a machine in another room. PACMAN works just fine remotely if you have unprivileged code execution.

 

[DeathtoGnomes]

You did check their paper? "Hardware" doesn't mean "physical access"

that little telltale section...

PACMAN works just fine remotely if you have unprivileged code execution.

always chokes me up.

 

[Steevo]

The speedup of speculative branching prediction/fetching and preprocessing is negated with thread and data security checks.


While I enjoy how soon after the **AMAZING, AWESOME, FAR SUPERIOR** M1 was released they have released a newer faster chip that will presumably have the same types of security issues. The fact is all CPU's could gain a decent IPC performance uplift if they were allowed to run code without security checks, and I would be down for trying or being able to buy a insecure piece of hardware, or if the big three would let us turn the security features on and off.

 

[ghazi]

You did check their paper? "Hardware" doesn't mean "physical access"

While "pathetic clickbait" is definitely not accurate, there is something to be said for the fact that if you already have unprivileged code execution these kinds of vulns are among the most inefficient possible ways to escalate privilege.

 

[mechtech]

Well at least the bug has a cool name.

watch out apple. I think ‘Pac-Man’ is
Trademarked by someone other than you.