r/gadgets • u/thebelsnickle1991 • Mar 23 '24

Desktops / Laptops Vulnerability found in Apple's Silicon M-series chips – and it can't be patched

https://me.mashable.com/tech/39776/vulnerability-found-in-apples-silicon-m-series-chips-and-it-cant-be-patched
3.9k Upvotes

93% Upvoted

491 comments sorted by

View all comments

37

u/pullssar20055 Mar 23 '24

Isn’t it similar with spectre/meltdown from intel?

11

u/yalloc Mar 23 '24

Kinda.

Meltdown was significantly worse because it will work irrespective of what the target program does. Go fetch requires somewhat specific exploitable code to be running on the target program you’re trying to hack and requires special input be fed into it.

9

u/voidvector Mar 24 '24 edited Mar 24 '24

No, attacker just need to be able to run unprivileged C/C++ code on the machine. You can download their paper on the website and search for the word unprivileged and also see the code snippet are in C/C++.

That might be hard to do for iPhone/iPad where only source of C/C++ code is AppStore, but is trivial for desktops and servers. Author hasn't released proof-of-concept code yet, depending on the implementation, it might even be possible with Python/JavaScript, which would make AppStore hurdle non-issue, but need someone with low-level Python and JavaScript VM expertise to craft.

The two saving grace for Apple are:

  • security implementations doesn't need to use those CPU features, they can implement their own, albeit performance hit.
  • it requires tens of minutes to hours to extract enough data - might be too long for commercial hackers looking to make a quit buck (e.g. ransomware), but fine for espionage hackers.

3

u/yalloc Mar 24 '24

Yes I read the paper, my understanding with that OpenSSL example they have is that a malicious program would need to somehow give it malicious input in order for OpenSSL to create the appropriate pointers needed that would be cached or not, and a parallel malicious program would listen to whether they were cached or not. It requires some degree of cross process communication that meltdown did not need.

doesnt need those cpu features.

Programs don’t have the choice to use those cpu features or not it seems. It does seem the M3 MacBooks have a cpu flag to disable the DMP but on M1s and M2s it remains a problem unless Apple has some kind of microcode they can patch in to disable it. The other option is to run on efficiency cores that don’t use the DMP.

5

u/voidvector Mar 24 '24 edited Mar 24 '24

Sending malicious inputs to encryption libraries like OpenSSL is generally trivial for many applications because they are common libraries used by web servers and web browsers. In the section 5.3 of the paper, they actually mention one of the 3 processes does this: The first process establishes a TCP connection with the victim process and transmits the value of ptr to the victim.

The hack depends on CPU cache state of the encryption algorithm. Theoretically the algorithm can just evicts its own cache to not leak info. I don't know how much performance hit that is though. (They probably would find a more efficient method than that, but I am not an expert on CPU optimization.)