Patchless Apple M-Chip Vulnerability Allows Cryptography Bypass
28-Mar-24
Apple’s M3 chips currently support DTI and thus are the only ones where the risk can be mitigated with the approach.
Meanwhile, developers of cryptographic applications will need to make other changes to address the vulnerability at the software level for devices running Apple’s M1 and M2 processors — there is no official workaround. Apple noted that even with the mitigation in place for the M3, developers will also “need additional programming practices to prevent other changes to the processor’s microarchitectural state from providing an adversary with signals about secret values,”
It’s unclear just how easy it might be for an attacker to exploit the vulnerability in Apple M-series chips. In the past, similar microprocessor vulnerabilities — most notably Spectre and Meltdown — have evoked widespread concern. Researchers have consistently uncovered new ways to exploit these vulnerabilities in side-channel attacks. The most recent example is GhostRace, a speculative execution vulnerability that affects almost all currently available Intel, AMD, ARM, and IBM processors.
