MIT's CSAIL lab is going to present a paper about a weakness in the ARM PAC implementation in the M1, which can be bypassed using (guess what) speculative execution.

Apparently the CPU doesn't fault when a speculatively executed instruction uses an address with incorrect PAC, only when committed. They found a way to brute force it via speculative execution and get feedback about which one is correct - perhaps timing related? With the M1 having 48 bits dedicated to address, that leaves a maximum of 16 bits for a PAC so it would be easily found. A15 added address bits so M2 will have even fewer bits for PAC. Not much "brute force" required, but if the tests are fast enough even 32 bits would not be sufficient.

This isn't a vulnerability by itself; it makes leveraging another vulnerability easier since the protection of PAC is nullified.

Perhaps the fix is to make the CPU fault when a speculatively executed instruction attempts to use an address with an incorrect PAC code? Not sure if doing that would cause other problems though.

https://www.theregister.com/2022/06/10/apple_m1_pacman_flaw/