'GoFetch' Flaw In Apple's M Chip Reveals Unfixable Vulnerability

(RTTNews) - A group of experts from various American universities has uncovered a new vulnerability in Apple Inc.'s (AAPL) M-series processors that could be leveraged to extract secret keys from Mac devices during cryptographic processes.

The researchers have dubbed this vulnerability "GoFetch," which exploits Data Memory-Dependent Prefetchers (DMPs) to predict and fetch upcoming data, to improve processing speed. However, this approach could inadvertently disclose information about the system's operations, making it a security risk. GoFetch is an advanced form of the Augury attack technique, which first emerged in 2022.

According to the study, DMPs, especially those found in Apple's processors, pose a significant threat to the security provided by constant-time programming models. The researchers have found that the GoFetch application can extract a 2048-bit RSA key in under an hour and a 2048-bit Diffie-Hellman key in slightly over two hours.

The researchers have confirmed that the M1 processors are vulnerable to this exploit, and given the comparable prefetching behavior of the M2 and M3 chips, they're likely to be vulnerable as well. Apple is presently looking into the issue, although fully addressing it appears to be difficult.

The researchers have recommended various countermeasures, but these may require complex hardware modifications or mitigations that could significantly impact performance. This vulnerability emphasizes the importance of the constant monitoring and updating of security measures to prevent any potential cyber threats.

The researchers' technical paper provides additional information on the GoFetch attack, with a proof-of-concept exploit set to be released later.