Skip to main content

The M1 has a major security loophole that Apple can’t patch

Researchers at MIT’s Computer Science and Artificial Intelligence Laboratory (CSAIL) have discovered a new security vulnerability that targets Apple’s popular M1 processor. The attack, dubbed PACMAN, is capable of bypassing the last line of defense against software bugs on the M1 and potentially other ARM-based processors.

PACMAN attacks pointer authentication, which is the final stop for most software vulnerabilities. Pointer authentication confirms that a program hasn’t been changed in any malicious way, serving as a “safety net … in the worst case scenario,” as MIT PhD student Joseph Ravichandran put it. MIT’s researchers developed PACMAN as a way to guess the pointer authentication signature, bypassing this critical security mechanism. Researchers say PACMAN exploits a hardware mechanism, so a software patch won’t be able to fix it.

Related Videos
Apple M1 processor on a mainboard.

The attack works by running all possible pointer authentication values through a hardware side channel, which reveals if the guess was correct or not. This all happens under speculative execution — basically running a computing task that’s not required at the time — which means there isn’t any trace left by PACMAN.

“The idea behind pointer authentication is that if all else has failed, you still can rely on it to prevent attackers from gaining control of your system,” Ravichandran, who co-wrote the PACMAN report, said. “We’ve shown that pointer authentication as a last line of defense isn’t as absolute as we once thought it was.”

Not a worry, for now

Although PACMAN is frightening for the M1 and other ARM-based systems that use pointer authentication, MIT researchers say there isn’t a reason to be worried now. PACMAN simply allows software bugs that would be blocked by pointer authentication through. In short, a software vulnerability must exist first for PACMAN to do anything.

For its part, Apple is usually quick to respond to vulnerabilities. Apple paid a student $100,000 for discovering a webcam hack on Macs earlier this year, for example, and a MacOS Monterey update in March fixed two major security flaws facing Macs. MIT says the PACMAN attack is focused more on the processors of the future.

iMac sit on display at the official opening of the new Apple Store Via Del Corso.
Antonio Masiello/Getty Images

Ravichandran told Digital Trends in an interview that it only targeted the M1, informing Apple of the issue in 2021. He says “the concerning question is not whether the current ARM processors are vulnerable, but whether future ARM processors are also vulnerable.” We reached out to ARM, which says it’s aware of the vulnerability and plans to publish an update on the ARM Security Center Developer site once its investigation is over.

We also reached out to Apple, which provided the following statement: “We want to thank the researchers for their collaboration as this proof of concept advances our understanding of these techniques. Based on our analysis as well as the details shared with us by the researchers, we have concluded this issue does not pose an immediate risk to our users and is insufficient to bypass operating system security protections on its own.”

Although PACMAN doesn’t pose an immediate threat to the M1, MIT’s findings don’t come at an opportune time. Apple just unveiled the M2 processor, which likely uses pointer authentication as well. Ravichandran offers some advice for issues that could arise out of PACMAN with future chips: “Developers should take care to not solely rely on pointer authentication to protect their software.”

Apple doesn’t seem too concerned, and neither do MIT’s researchers. Ravichandran says that, although pointer authentication is “used all over the place in PAC-enabled binaries (such as the macOS kernel),” it only works “as a last step in exploitation, when everything except for pointer authentication has been bypassed.”

That doesn’t mean PACMAN is harmless, though. Ravichandran warned that “using PACMAN to bypass pointer authentication opens the door to arbitrary code execution, which would give the attacker complete control of a device.” Researchers also suspect that future ARM processors with pointer authentication could be vulnerable, too.

This isn’t the first vulnerability the M1 has faced. Researchers spotted a hardware-based security vulnerability in the M1 in May, but it wasn’t considered a major problem and hasn’t caused widespread issues.

MIT researchers will present their full findings on June 18 at the International Symposium on Computer Architecture.

How you can protect yourself

PACMAN doesn’t pose an immediate threat, so there’s nothing you need to do now to protect yourself. Because PACMAN only works if software bugs exist, it’s important to keep MacOS and your software up to date. Make sure to read our guide on how to update your Mac and frequently check for software updates for the apps installed on your computer.

Ravichandran echoed that advice: “Keep your software up to date!”

Editors' Recommendations

I’m still waiting for Apple to fix the Mac Mini’s major problem
The M1-powered Mac Mini.

As a desktop machine, my M1 Mac Mini is absolutely great. It’s small enough to pop into a backpack, but capable enough to handle my workloads with ease. Yet there’s one problem nagging at me that makes me worried for the future of the Mac Mini line -- and it likely won’t be fixed any time soon.

That’s because, while the Mac Mini is ideal for most of my work, there are times when I wish it had a bit more power. That doesn’t come up often -- it’s mainly when I’m playing and reviewing Mac games. I’ll often have to turn the settings down lower than I’d like, which is perhaps unsurprising given that the M1’s integrated graphics were part of Apple’s first stab at its own desktop chip.

Read more
I replaced my MacBook with a Quest Pro for a full work week. Here’s what happened
Alan Truly is wearing his Quest Pro and holding a laptop with a message: M1 MacBook Air gets the week off.

Meta says headsets like the Quest Pro need to be able to replace a laptop if they're ever going to truly catch on. So, why not give it a shot? I tried using a Meta Quest Pro to replace my beloved M1 MacBook Air for a full week -- just to see what happened.

It was surprising in many ways, sometimes actually exceeding the productivity of my laptop, while other workflows proved frustrating and required some serious workarounds. Here's my day-by-day journal of making it all work.
Day one: a promising start

Read more
Apple’s M2 Max chip may bring next-level performance to the MacBook Pro
An Apple M2 chip on a stylized gradient background.

Apple's M2 Max chip is not out yet, but some benchmarks of it already are. One such test was leaked today, showing off the performance of the new processor.

According to these scores, we might see a decent performance boost in the future MacBook Pros that will likely come with the M2 Max chip. Of course, things can still improve.

Read more