Vulnerability found in Apple's Silicon M-series chips

[hohohong]

Vulnerability found in Apple's Silicon M-series chips – and it can't be patched

A major vulnerability has been found in Apple M-Series Silicon chips.

mashable.com

This news was released when apple released M3 chip MBA.

I read, M1-3 are affected. Did M4 fixed this vulnerability? Will Apple replace M3 MBA with M4 MBA this summer?

 

[galad]

Actually it can be patched, there is a flag that can be enabled to run such code in a secure way. So it's not really an issue.

 

[tomekwsrod]

Actually it can be patched, there is a flag that can be enabled to run such code in a secure way. So it's not really an issue.

Has a patch been released? Has anyone measured the impact of the patch on performance? Is this issue fixed in M4 by design not patch?

 

[krspkbl]

Has a patch been released? Has anyone measured the impact of the patch on performance? Is this issue fixed in M4 by design not patch?

Nobody knows except Apple.

A cpu exploit might need a bios/firmware update to change the microcode instead of just a MacOS patch but Apple will patch it if they haven't already. The M4 might have a hardware fix like the spectre/meltdown exploits on x86 cpus years ago.

Too early to say. We only have M4 in the iPad Pro so far.

 

[cjsuk]

Less of an issue for end users. I mean you're going to have a process whacking your CPU hard for an hour on your computer to extract a key which probably isn't in RAM anywhere for very long (or at least shouldn't be). There are likely many more lower hanging fruit than that!

This sort of thing is much more of a problem in cloud servers because you can extract keys across logical tenants on a hypervisor potentially. x86-64 scared me a lot more than this.

 

[NoBoMac]

Being discussed here:

Apple Silicon Vulnerability Allows Hackers to Extract Encryption Keys

An unpatchable vulnerability has been discovered in Apple's M-series chips that allows attackers to extract secret encryption keys from Macs under certain conditions, according to a newly published academic research paper (via ArsTechnica). Named "GoFetch," the type of cyber attack described...

forums.macrumors.com