Security News > 2024 > March > New GoFetch Vulnerability in Apple’s M Chips Allows Secret Keys Leak on Compromised Computers

The newly exposed GoFetch vulnerability affecting Apple's M1, M2 and M3 chips lets an attacker exfiltrate secret keys from cryptographic applications on a targeted system.

DMPs - in contrast to classical prefetchers that only store the memory access pattern - "Also take into account the contents of data memory directly to determine what to prefetch," as written in the publication from Boru Chen, Yingchen Wang, Pradyumna Shome, Christopher W. Fletcher, David Kohlbrenner, Riccardo Paccagnella and Daniel Genkin that reveals all of the details about the GoFetch vulnerability.

The DMP has a behavior that makes the GoFetch vulnerability possible: it sometimes confuses memory content with the pointer value that is used to load other data.

As explained by the researchers, the GoFetch vulnerability can be exploited by crafting "Chosen inputs to cryptographic operations, in a way where pointer-like values only appear if we have correctly guessed some bits of the secret key." Therefore, by repeating those operations on different bits, it becomes possible to guess all bits of a secret key.

Apple computers possessing the M1, M2 or M3 chip are vulnerable to GoFetch.

There is a difference on the M3 because disabling the Data Independent Timing bit disables the DMP, which is not possible on the M1 and M2. The researchers noted similar DMP exists on Intel's latest 13th generation architecture, yet with more restrictive activation criteria, making it robust to the GoFetch vulnerability.

News URL

https://www.techrepublic.com/article/gofetch-vulnerability-apple-m-chips/