Apple M-Series CPUs Affected by "GoFetch" Unpatchable Cryptographic Vulnerability

[natr0n]

"Goes into vault... I guess I have to update everything"

 

[R-T-B]

Lol unpatchable wait what? Does Apple not have some kind of Microcode/AGESA type firmware they catch patch at the bios level like Intel/AMD?

It's a silicon level flaw, not microcode level.

 

[user556]

What the frig is "data and memory"?

 

[R-T-B]

What the frig is "data and memory"?

Memory is a box. Data is what you put in the box.

 

[nulshift]

Well here's the added value: people with old computers will be forced to upgrade too.

Found the e-waste enthusiast. There really isn't a point to replacing what still works great.

 

[user556]

Memory is a box. Data is what you put in the box.

Right, so how can one achieve the mixing of data and memory access patterns?

 

[R-T-B]

Right, so how can one achieve the mixing of data and memory access patterns?

You are getting a bit complicated for a layman explanation, but it would mean combining a certain memory address with certain memory contents.

ROWHAMMER memory attacks are an example of such a thing.

 

[marios15]

This looks more like skipping security checks to gain performance like for example meltdown

Give them another 10 years and all those skipped security checks will require enough transistors to match x86 power efficiency

Oh and this bit is great:

As an Apple user, there is not much you can do other than practice safe computing habits....
...
The GoFetch attack does not require physical access for exploitation, so if the attacker can run code on the target machine, for example, via malware infection, it can be executed remotely.


This is the perfect backdoor lol. Thanks for the "privacy & security" section.

 

[user556]

You are getting a bit complicated for a layman explanation, but it would mean combining a certain memory address with certain memory contents.

C'mon, using an address as data is just more data.

 

[TechLurker]

Big "oof" moment, right as they're pushing M3 and it supposedly being faster than M1 and M2. I wonder if mitigations would also kill performance to be equal or worse to M1 or M2 without mitigations.

On the other end, if this makes some M2 products cheaper, I might just go for a larger M2 tablet, just to play the 2 iPad exclusive games I'm playing on a smaller refurbished M1, as well as being a bigger e-reader (which I also use the tiny M1 for).

 

[user556]

Given the likely performance hit, I'm guessing Apple won't worry about mitigating it via software because the vulnerability can't be remotely exploited by itself anyway. An attack would first need a way to be executed as native code locally on the target machine.

 

[R-T-B]

C'mon, using an address as data is just more data.

That's not how addressing works. An address is a particular place, not more data. In the example of a rowhammer attack, that is on the edge of a row boundary in memory, combined with a repeated write operation of a "1" pattern which can induce a bitflip.

I'm more fuzzy on the details here.

 

[bug]

Forcing developers to upgrade is an industry wide thing. To be perfectly frank; developers don't upgrade enough. You should be developing in the environment you develop for. Not using a 2013 Thinkpad hackintosh'd running every back-channel workaround to make XCode work properly.

No this was about current macbooks. And as I have said, it was about some instruction for the cryptographic signature it had nothing to do with "You should be developing in the environment you develop for". Which is idiotic in its own way, I clearly stated this was a requirement for submitting to the AppStore. If developers followed you advice, they'd be developing iOS apps on iPhones.
(Fwiw, I understand what you meant, you just didn't word that very well.)

 

[Vayra86]

Now watch Apple create a proprietary adapter with a chip in it for hardware mitigation.

And sell it at $299,-

 

[Guwapo77]

Intel has had unpatchable CPUs in the past - CVE-2019-0090 and I'm sure more will come in the future. AMD's Tesla chip is unpatchable. Its unfortunate, but it happens. All these chip makers can do is fix it with an upcoming silicon. So good luck fellow hardware enthusiast, lets hope nothing we currently own reveals an unpatchable vulnerability. Practices safe surfing!

 

[user556]

That's not how addressing works. An address is a particular place, not more data. In the example of a rowhammer attack, that is on the edge of a row boundary in memory, combined with a repeated write operation of a "1" pattern which can induce a bitflip.

I'm more fuzzy on the details here.

Yep, but fiddling the order of addressing doesn't seem much like "mixing data and memory" to me.

 

[R-T-B]

Yep, but fiddling the order of addressing doesn't seem much like "mixing data and memory" to me.

I mean it's somewhat awkward wording sure but it's what it means.

 

[user556]

I have my doubts. It's just the flip of what I said earlier. Using data for making up addresses is likewise just more addresses. It stops being data.

 

[kapouer]

Forcing developers to upgrade is an industry wide thing. To be perfectly frank; developers don't upgrade enough. You should be developing in the environment you develop for. Not using a 2013 Thinkpad hackintosh'd running every back-channel workaround to make XCode work properly.

Developers DO upgrade more than common people.
I upgraded my 2011 iMac to latest linux 6.6.15 last month (along with gnome graphical env, on debian trixie).

However I CANNOT upgrade OSX because they stopped support for that iMac.
Even with OpenCore-Legacy-Patcher, it's barely usable, and feels so slow (and hot !) when compared to linux.
If there was a carbon tax, using linux would become mandatory

 

[unwind-protect]

More bad news for AMD:

ZenHammer: Rowhammer Attacks on AMD Zen-based Platforms - Computer Security Group

Our work shows that it is possible to trigger Rowhammer bit flips on DDR4 devices on AMD Zen 2 and Zen 3 systems despite deployed TRR mitigations. This result proves that AMD systems are equally vulnerable to Rowhammer as Intel systems, which greatly increases the attack surface, considering...

comsec.ethz.ch

 

[Aleksandar_038]

More bad news for AMD:

ZenHammer: Rowhammer Attacks on AMD Zen-based Platforms - Computer Security Group

Our work shows that it is possible to trigger Rowhammer bit flips on DDR4 devices on AMD Zen 2 and Zen 3 systems despite deployed TRR mitigations. This result proves that AMD systems are equally vulnerable to Rowhammer as Intel systems, which greatly increases the attack surface, considering...

comsec.ethz.ch

How this is connected to Apple M-series ?