Led by MIT’s Mengjia Yan, researchers from MIT’s Computer Science and Artificial Intelligence Laboratory (MIT CSAIL) created the novel attack using a combination of memory corruption and speculative execution to bypass the M1’s security. The research team’s proof of concept also demonstrated the attack’s effectiveness against the CPU kernel, which could have far-reaching impacts on any PAC-enabled ARM system. A PAC typically guards the OS kernel by causing any mismatch between a PAC pointer and its authentication code to result in a crash. The PACMAN attack’s reliance on speculative execution and repeated guesses is critical to its success. Due to the finite number of PAC values, the team determined that it would be possible for a malicious actor to find the correct PAC value by simply trying them all. However, this requires the ability to make multiple guesses without triggering an exception any time the values are incorrectly guessed. The researchers figured out a way to do just that.
According to the team, a given malware exploit would have a 1 in 65,000 chance of guessing the correct code and not producing an exception. Unlike other malware, PACMAN can prevent these wrong guesses from triggering an exception, resulting in the ability to avoid crashes. Once guessed, the malware can inject malicious code into the target’s memory without resistance. Despite the MIT team’s findings, a statement by Apple’s Scott Radcliffe attempted to downplay the discovery and its potential impact. “[The exploit] does not pose an immediate threat to our users and is insufficient to bypass operating system security protections on its own,” said Radcliffe. Apple currently uses PAC on all of their custom ARM products. Other manufacturers, including Qualcomm and Samsung, have also signified their intent to employ the codes as a hardware-level security feature. According to the research team, failure to somehow mitigate the exploit will impact most mobile (and potentially desktop) devices. Image credit: PACMAN attack
