Pointer authentication flaw in M1

By: Doug S (foo.delete@this.bar.bar), June 10, 2022 11:52 am
Room: Moderated Discussions
MIT's CSAIL lab is going to present a paper about a weakness in the ARM PAC implementation in the M1, which can be bypassed using (guess what) speculative execution.

Apparently the CPU doesn't fault when a speculatively executed instruction uses an address with incorrect PAC, only when committed. They found a way to brute force it via speculative execution and get feedback about which one is correct - perhaps timing related? With the M1 having 48 bits dedicated to address, that leaves a maximum of 16 bits for a PAC so it would be easily found. A15 added address bits so M2 will have even fewer bits for PAC. Not much "brute force" required, but if the tests are fast enough even 32 bits would not be sufficient.

This isn't a vulnerability by itself; it makes leveraging another vulnerability easier since the protection of PAC is nullified.

Perhaps the fix is to make the CPU fault when a speculatively executed instruction attempts to use an address with an incorrect PAC code? Not sure if doing that would cause other problems though.

https://www.theregister.com/2022/06/10/apple_m1_pacman_flaw/
 Next Post in Thread >
TopicPosted ByDate
Pointer authentication flaw in M1Doug S2022/06/10 11:52 AM
  Pointer authentication flaw in M1Adrian2022/06/10 12:11 PM
    Pointer authentication flaw in M1anon22022/06/11 04:40 AM
      Pointer authentication flaw in M1Anon42022/06/11 06:26 AM
        Pointer authentication flaw in M1anon22022/06/11 05:00 PM
      Pointer authentication flaw in M1---2022/06/11 02:45 PM
        Pointer authentication flaw in M1anon22022/06/11 05:06 PM
          Pointer authentication flaw in M1Linus Torvalds2022/06/12 11:04 AM
            Pointer authentication flaw in M1Linus Torvalds2022/06/12 11:33 AM
              Pointer authentication flaw in M1quackslikeaduck@quack.duck.com2022/06/12 03:54 PM
                Pointer authentication flaw in M1Doug S2022/06/12 05:58 PM
            Pointer authentication flaw in M1anon22022/06/12 09:17 PM
              solution simple, but hard to accepthobold2022/06/12 10:31 PM
                solution simple, but hard to acceptMichael S2022/06/13 12:19 AM
                  solution simple, but hard to accepthobold2022/06/13 01:20 AM
                solution simple, but hard to acceptLinus Torvalds2022/06/13 11:24 AM
                  solution simple, but hard to acceptDoug S2022/06/13 12:12 PM
                  solution simple, but hard to accepthobold2022/06/13 12:15 PM
                    solution simple, but hard to acceptAdrian2022/06/13 12:44 PM
                      solution simple, but hard to accepthobold2022/06/13 02:54 PM
                  solution simple, but hard to accept---2022/06/13 09:23 PM
                solution simple, but hard to acceptanon22022/06/13 02:18 PM
                  solution simple, but hard to accepthobold2022/06/13 02:43 PM
                    solution simple, but hard to acceptanon22022/06/13 03:11 PM
                      solution simple, but hard to accepthobold2022/06/13 11:42 PM
                        solution simple, but hard to acceptDoug S2022/06/14 10:46 AM
                          solution simple, but hard to accepthobold2022/06/14 01:22 PM
                          solution simple, but hard to acceptLinus Torvalds2022/06/14 02:44 PM
        CHERI?Brendan2022/06/11 09:40 PM
          CHERI?Simon Farnsworth2022/06/12 02:09 AM
            CHERI?Brendan2022/06/12 09:55 AM
              CHERI?Simon Farnsworth2022/06/13 01:14 AM
                CHERI?Michael S2022/06/13 02:05 PM
                CHERI?Brendan2022/06/13 02:23 PM
                  CHERI?dmcq2022/06/14 03:10 PM
                    CHERI?Brendan2022/06/14 03:46 PM
          CHERI?dmcq2022/06/12 04:57 AM
            CHERI?Anon42022/06/12 07:06 AM
          CHERI -> Implemented as Morello by Armnone2022/06/13 01:45 AM
Reply to this Topic
Name:
Email:
Topic:
Body: No Text
How do you spell avocado?