Skip to main content

The M1 has a major security loophole that Apple can’t patch

Researchers at MIT’s Computer Science and Artificial Intelligence Laboratory (CSAIL) have discovered a new security vulnerability that targets Apple’s popular M1 processor. The attack, dubbed PACMAN, is capable of bypassing the last line of defense against software bugs on the M1 and potentially other ARM-based processors.

PACMAN attacks pointer authentication, which is the final stop for most software vulnerabilities. Pointer authentication confirms that a program hasn’t been changed in any malicious way, serving as a “safety net … in the worst case scenario,” as MIT PhD student Joseph Ravichandran put it. MIT’s researchers developed PACMAN as a way to guess the pointer authentication signature, bypassing this critical security mechanism. Researchers say PACMAN exploits a hardware mechanism, so a software patch won’t be able to fix it.

Apple M1 processor on a mainboard.
Image used with permission by copyright holder

The attack works by running all possible pointer authentication values through a hardware side channel, which reveals if the guess was correct or not. This all happens under speculative execution — basically running a computing task that’s not required at the time — which means there isn’t any trace left by PACMAN.

“The idea behind pointer authentication is that if all else has failed, you still can rely on it to prevent attackers from gaining control of your system,” Ravichandran, who co-wrote the PACMAN report, said. “We’ve shown that pointer authentication as a last line of defense isn’t as absolute as we once thought it was.”

Not a worry, for now

Although PACMAN is frightening for the M1 and other ARM-based systems that use pointer authentication, MIT researchers say there isn’t a reason to be worried now. PACMAN simply allows software bugs that would be blocked by pointer authentication through. In short, a software vulnerability must exist first for PACMAN to do anything.

For its part, Apple is usually quick to respond to vulnerabilities. Apple paid a student $100,000 for discovering a webcam hack on Macs earlier this year, for example, and a MacOS Monterey update in March fixed two major security flaws facing Macs. MIT says the PACMAN attack is focused more on the processors of the future.

iMac sit on display at the official opening of the new Apple Store Via Del Corso.
Antonio Masiello/Getty Images

Ravichandran told Digital Trends in an interview that it only targeted the M1, informing Apple of the issue in 2021. He says “the concerning question is not whether the current ARM processors are vulnerable, but whether future ARM processors are also vulnerable.” We reached out to ARM, which says it’s aware of the vulnerability and plans to publish an update on the ARM Security Center Developer site once its investigation is over.

We also reached out to Apple, which provided the following statement: “We want to thank the researchers for their collaboration as this proof of concept advances our understanding of these techniques. Based on our analysis as well as the details shared with us by the researchers, we have concluded this issue does not pose an immediate risk to our users and is insufficient to bypass operating system security protections on its own.”

Although PACMAN doesn’t pose an immediate threat to the M1, MIT’s findings don’t come at an opportune time. Apple just unveiled the M2 processor, which likely uses pointer authentication as well. Ravichandran offers some advice for issues that could arise out of PACMAN with future chips: “Developers should take care to not solely rely on pointer authentication to protect their software.”

Apple doesn’t seem too concerned, and neither do MIT’s researchers. Ravichandran says that, although pointer authentication is “used all over the place in PAC-enabled binaries (such as the macOS kernel),” it only works “as a last step in exploitation, when everything except for pointer authentication has been bypassed.”

That doesn’t mean PACMAN is harmless, though. Ravichandran warned that “using PACMAN to bypass pointer authentication opens the door to arbitrary code execution, which would give the attacker complete control of a device.” Researchers also suspect that future ARM processors with pointer authentication could be vulnerable, too.

This isn’t the first vulnerability the M1 has faced. Researchers spotted a hardware-based security vulnerability in the M1 in May, but it wasn’t considered a major problem and hasn’t caused widespread issues.

MIT researchers will present their full findings on June 18 at the International Symposium on Computer Architecture.

How you can protect yourself

PACMAN doesn’t pose an immediate threat, so there’s nothing you need to do now to protect yourself. Because PACMAN only works if software bugs exist, it’s important to keep MacOS and your software up to date. Make sure to read our guide on how to update your Mac and frequently check for software updates for the apps installed on your computer.

Ravichandran echoed that advice: “Keep your software up to date!”

Editors' Recommendations

Jacob Roach
Senior Staff Writer, Computing
Jacob Roach is a writer covering computing and gaming at Digital Trends. After realizing Crysis wouldn't run on a laptop, he…
This docking station solves the M1 Mac’s biggest weakness
ugreen docking station could solve m1 macs major weakness

Accessory brand Ugreen has just released a 12-in-1 MacBook docking station that can extend or mirror as many as three external displays at 4K 60Hz.

M1 MacBook Air and MacBook Pro are fantastic laptops but came with two flaws. One is limited I/O (you get only two ports on either model), and the other is the native ability to drive only one external monitor.

Read more
This reliable leaker has some bad news about Apple’s M2 Pro chips
A digital illustration of the Apple M2 chip with a blue and purple color scheme.

We previously reported on rumors of Apple's upcoming M2 Pro chip using TSMC's 3nm processes this fall, but it seems those rumors were wrong. Reliable sources now say Apple is sticking with 5nm processes for the M2 Pro and M2 Max chips.

The first report comes from reliable industry analyst Ming-Chi Kuo, who posted several leaks on Twitter yesterday. He said the new 14-inch and 16-inch MacBook Pros with M2 chips will keep their current 5nm processes, with mass production slated for late 2022.

Read more
Apple MacBook Air M2 buying guide: don’t buy the wrong one
The MacBook Air on a table in front of a window.

The MacBook Air M2 is Apple's latest swing at its fanless Air design. Like the M1 model, it's among the best laptops you can buy right now because of its excellent portability, battery life, and, above all, performance. But buying the wrong MacBook Air M2 could result in a laptop that's up to 50% slower. Seriously.

In this guide, we're going to break down what the M2 MacBook Air is, the different configurations available, and answer if you should buy Apple's latest laptop. Most importantly, we'll guide you to the configuration you should buy to avoid a clear performance pitfall.
Here's the M2 MacBook Air

Read more