{"id":41079,"date":"2021-05-27T01:38:09","date_gmt":"2021-05-27T01:38:09","guid":{"rendered":"https:\/\/www.threatshub.org\/blog\/unfixable-apple-m1-chip-bug-enables-cross-process-chatter-breaking-os-security-model\/"},"modified":"2021-05-27T01:38:09","modified_gmt":"2021-05-27T01:38:09","slug":"unfixable-apple-m1-chip-bug-enables-cross-process-chatter-breaking-os-security-model","status":"publish","type":"post","link":"https:\/\/www.threatshub.org\/blog\/unfixable-apple-m1-chip-bug-enables-cross-process-chatter-breaking-os-security-model\/","title":{"rendered":"Unfixable Apple M1 chip bug enables cross-process chatter, breaking OS security model"},"content":{"rendered":"

Apple’s Arm-based M1 chip, much ballyhooed for its performance<\/a>, contains a design flaw that can be exploited to allow different processes to quietly communicate with one another, in violation of operating system security principles.<\/p>\n

M1RACLES, as the bug has been called, doesn’t pose a major security risk because information leakage is already possible through a variety of other side channels. It does, however, add another way for malware already running on affected hardware to conduct covert communication. In other words, it just makes a bad situation a little bit worse.<\/p>\n

The flaw arises from the fact that the Arm system register encoded as s3_5_c15_c10_1 contains two bits that can be read and written at EL0 (Exception Level 0<\/a>, application level privilege) from all cores simultaneously. In a secure system, cross-process chatter is restricted to keep secrets from being revealed.<\/p>\n