M1 architecture bug - Front Page

Jump to latest Follow Reply
armwt

armwt

Ars Legatus Legionis
18,087
Moderator
  • #1
    FYI - Dan has an article up on the front page describing a newly-revealed bug on Apple Silicon CPU's which can leak crypto keys. At 1st glance, looks similar to Intel's Specter and Meltdown bugs, but a little less obvious. Likely not a major issue for individual, personal use, but I anticipate I'm going to get asked about this a lot over the next few weeks, working in FinTech and anyone in similar environments should start thinking of their response to something like this.

    arstechnica.com

    Unpatchable vulnerability in Apple chip leaks secret encryption keys

    Fixing newly discovered side channel will likely take a major toll on performance.
    arstechnica.com arstechnica.com
     
    • Like
    Reactions: mklein
    C

    chris_f

    Ars Scholae Palatinae
    1,271
  • #4
    armwt said:
    FYI - Dan has an article up on the front page describing a newly-revealed bug on Apple Silicon CPU's which can leak crypto keys. At 1st glance, looks similar to Intel's Specter and Meltdown bugs, but a little less obvious. Likely not a major issue for individual, personal use, but I anticipate I'm going to get asked about this a lot over the next few weeks, working in FinTech and anyone in similar environments should start thinking of their response to something like this.

    arstechnica.com

    Unpatchable vulnerability in Apple chip leaks secret encryption keys

    Fixing newly discovered side channel will likely take a major toll on performance.
    arstechnica.com arstechnica.com
    Click to expand...
    This isn't just limited to M1. The thread subject narrows it a bit too much.
     
    FoO

    FoO

    Ars Legatus Legionis
    13,017
    Subscriptor++
  • #5
    chris_f said:
    This isn't just limited to M1. The thread subject narrows it a bit too much.
    Click to expand...
    Yeah, it includes M2 but doesn't provide any certainty about M3 - I assume because it's not known for certain, but likely to have very similar architecture - which is disappointing because I'm trying to get an M3 purchased soon. Guess I'm waiting a bit longer.

    :: pats his trusty Late 2013 15" MBP as parts and dust fall out of it::
     
    Last edited:
    Megalodon

    Megalodon

    Ars Legatus Legionis
    34,201
    Subscriptor++
  • #6
    armwt said:
    FYI - Dan has an article up on the front page describing a newly-revealed bug on Apple Silicon CPU's which can leak crypto keys. At 1st glance, looks similar to Intel's Specter and Meltdown bugs, but a little less obvious. Likely not a major issue for individual, personal use, but I anticipate I'm going to get asked about this a lot over the next few weeks, working in FinTech and anyone in similar environments should start thinking of their response to something like this.
    Click to expand...

    Reading about this I don't think it's that closely related to spectre or meltdown, in that those are both speculative execution, and this is speculative memory load. Apart from fitting under the broad category of side channels it's quite distinct.

    The specific type of bug makes it trickier in some ways, easier in others. The OS doesn't have to patch everyone the same way and doesn't have to slow down all workloads, which is an upside. But by the same token any application including its own crypto libraries cannot be patched by the OS, so you are reliant on each application getting its act together, which means a lot of legwork to confirm everything is fixed if you're in a compliance type scenario or just want to make sure you are personally protected.
     
    Megalodon

    Megalodon

    Ars Legatus Legionis
    34,201
    Subscriptor++
  • #7
    FoO said:
    Yeah, it includes M2 but doesn't provide any certainty about M3 - I assume because it's not known for certain, but likely to have very similar architecture - which is disappointing because I'm trying to get an M3 purchased soon. Guess I'm waiting a bit longer.
    Click to expand...

    The article suggests newer ARM features allow the application to set a data independent timing mode, and that M3 implements that mode. Whether Apple's implementation is fully compliant or whether the performance impact is worse than just doing other software workarounds is unclear.
     
    W

    wco81

    Ars Legatus Legionis
    28,661
  • #9
    Wonder how much of a hit on performance it will require and whether it can be fixed in time for the M4 or whether we‘d need to wait for the M5.

    Would the architectural changes cause a hit in performance even with newer AS? Either they don’t deliver the performance jump over current AS they Otherwise would have had or maybe they may even turn out slower because the prefetcher implementation is a major part of the AS architecture performance?
     
    Megalodon

    Megalodon

    Ars Legatus Legionis
    34,201
    Subscriptor++
  • #10
    wco81 said:
    Wonder how much of a hit on performance it will require and whether it can be fixed in time for the M4 or whether we‘d need to wait for the M5.

    Would the architectural changes cause a hit in performance even with newer AS? Either they don’t deliver the performance jump over current AS they Otherwise would have had or maybe they may even turn out slower because the prefetcher implementation is a major part of the AS architecture performance?
    Click to expand...

    Unclear, but: fixing it in hardware almost always reduces the performance impact relative to fixing it in software, and they can add other improvements concurrently to compensate.
     
    Megalodon

    Megalodon

    Ars Legatus Legionis
    34,201
    Subscriptor++
  • #12
    The Limey said:
    Have I missed anywhere whether is also present on the A series of chips?
    Click to expand...
    Very likely yes.

    The Limey said:
    If so, that’s perhaps more of a worry - I know that I generally feel fairly safe downloading apps from the App Store, knowing they are locked in the app sandbox. This presumably breaks that assumption?
    Click to expand...
    I think you're probably over-indexing on the resilience of the sandbox.
     
    You must log in or register to reply here.
    Jump to latest Follow Reply
    Jump to latest Follow Reply