Researchers have uncovered a new attack vector that enables hostile actors to bypass the M1’s security protections.
The vulnerability completely bypasses the CPU’s Pointer Authentication Codes (PAC), which are designed to protect against malicious code injection.
Due to the exploit’s hardware-based nature, it also leaves no record of an attack and cannot be patched proactively.
Researchers from MIT’s Computer Science and Artificial Intelligence Laboratory (MIT CSAIL), led by Mengjia Yan, developed the innovative attack by combining memory corruption and speculative execution to get beyond the M1’s security.
The attack’s efficacy against the CPU kernel was also demonstrated by the study team’s proof of concept, which might have far-reaching implications for any PAC-enabled ARM machine.
A PAC usually protects the OS kernel by creating a crash if a PAC pointer and its verification code don’t match.
The success of the PACMAN attack is dependent on speculative execution and repetitive guesses.
Because there are a finite amount of PAC values, the researchers found that a malicious actor could pick the appropriate PAC value by simply testing all of them.
This, however, necessitates the capacity to make many guesses without throwing an exception if the values are estimated erroneously. The researchers devised a method to accomplish this.
According to the researchers, a malware attack has a 1 in 65,000 chance of picking the correct code and failing to throw an exception.
PACMAN, unlike other malware, can prevent these incorrect estimates from causing an exception, allowing it to avoid crashes.
The malware can inject malicious code into the target’s memory without resistance after it has been guessed.
Despite the findings of the MIT study, Apple’s Scott Radcliffe aimed to limit the significance of the discovery in a statement.
“[The exploit] does not pose an immediate threat to our users and is insufficient to bypass operating system security protections on its own,” said Radcliffe.
All of Apple’s bespoke ARM products presently use PAC. Other companies, including Qualcomm and Samsung, have expressed interest in using the codes as a hardware-level security feature.
According to the research group, if the vulnerability is not mitigated in some way, it will affect the majority of mobile (and possibly desktop) devices.
To read our blog on “Apple M1 contains an extremely odd GPU,” click here.
