A newly discovered vulnerability baked into Apple’s M-series of chips allows attackers to extract secret keys from Macs when they perform widely used cryptographic operations, academic researchers have revealed in a paper published Thursday.

The flaw—a side channel allowing end-to-end key extractions when Apple chips run implementations of widely used cryptographic protocols—can’t be patched directly because it stems from the microarchitectural design of the silicon itself. Instead, it can only be mitigated by building defenses into third-party cryptographic software that could drastically degrade M-series performance when executing cryptographic operations, particularly on the earlier M1 and M2 generations. The vulnerability can be exploited when the targeted cryptographic operation and the malicious application with normal user system privileges run on the same CPU cluster.

  • SteefLem
    link
    English
    79 months ago

    So apple want everyone that has a m1 or m2 to buy the……m3 :) Joke. But thats serious fuck up.

    • hudson
      link
      fedilink
      English
      29 months ago

      It sounds pretty bad, but, fortunately, it’s able to be mitigated with software patches. for now, anyway. Also, fortunately, it’s in older–series chips and won’t present a problem moving forward with newer series chips.

      Still, not good.

      • @Ptsf
        link
        English
        19 months ago

        The vulnerability is actually present in modern series chips as well, it’s just that they include an optional chip flag that cryptography libraries may leverage to disable the speculative processing that causes the leak.