Asahi Linux Dev Reveals 'M1RACLES' Flaw in Apple M1, Pokes Fun at Similar Flaws
Asahi Linux developer Hector Martin has revealed a covert channel vulnerability in the Apple M1 chip that he dubbed M1RACLES, and in the process, he's gently criticized the way security flaws have started to be shared with the public.
Martin's executive summary for M1RACLES sounds dire: "A flaw in the design of the Apple Silicon 'M1' chip allows any two applications running under an OS to covertly exchange data between them, without using memory, sockets, files, or any other normal operating system features. This works between processes running as different users and under different privilege levels, creating a covert channel for surreptitious data exchange. [...] The vulnerability is baked into Apple Silicon chips, and cannot be fixed without a new silicon revision." (Emphasis his.)
He also noted that this was the result of an intentional decision on Apple's part. "Basically, Apple decided to break the ARM spec by removing a mandatory feature, because they figured they'd never need to use that feature for macOS," he explained. "And then it turned out that removing that feature made it much harder for existing OSes to mitigate this vulnerability." The company would have to make a change on the silicon level with its followup to the M1 to mitigate this flaw.
(Score: 3, Interesting) by Anonymous Coward on Friday May 28 2021, @05:03AM (3 children)
Seriously, read the website for this expoilt. It includes many gems:
But it also has some meat too:
(Score: 2) by DECbot on Friday May 28 2021, @02:25PM (1 child)
What are you worried about? Only the NSA will ever find a use for this.
cats~$ sudo chown -R us /home/base
(Score: 0) by Anonymous Coward on Friday May 28 2021, @08:57PM
Thing is that the NSA doesn't need to use this. There are already thing they can use with higher bandwidth, harder to spot, not mitigatible as easily, and more robust.
(Score: 2) by choose another one on Friday May 28 2021, @06:47PM
2 + 2 = ???
Apple: we protect your privacy, apps are no longer allowed to ship out your data wholesale over normal channels
Hacker: oops, I found this covert channels thing baked into Apple silicon, posted about it before I knew it was a bug and not a feature
Apple: bugger, that intentional-but-plausibly-deniable covert channels feature was spotted fast, do you think anyone will catch on to why it was there?
(Score: 0) by Anonymous Coward on Friday May 28 2021, @07:09AM
... they are simply clairvoyant.