PACMAN SOFTWARE
PACMAN CODE

In principle, a PACMAN Gadget is a code sequence that uses a signed pointer speculatively. The PACMAN Gadget executes the test case speculatively, and we learn the results of the test via a microarchitectural side channel. The existing memory corruption bug is used to supply guesses to the PACMAN Gadget (by overwriting pointers that only get used speculatively). We use an existing memory corruption bug and a PACMAN Gadget to construct the PAC Oracle. We then use a microarchitectural side channel to learn whether the guessed PAC was correct.Ī PACMAN Gadget is a code sequence in the victim process that authenticates and tries to use a pointer speculatively. We suppress crashes by performing each PAC guess speculatively to prevent any crashes. We then brute force all possible PAC values using the PAC Oracle. The PAC Oracle must never crash if an incorrect guess is supplied. PACMAN does this by creating what we call a PAC Oracle, which is the ability to tell if a given PAC matches a specified pointer. In order to do this, we need to learn what the PAC value is for a particular victim pointer.

PACMAN SOFTWARE

PACMAN takes an existing software bug (memory read/ write) and turns it into a more serious exploitation primitive (a pointer authentication bypass), which may lead to arbitrary code execution. We reported our findings and proof-of-concept code to Apple, and have been in talks with them since 2021. So, an attacker with an existing bug could do the same attack without the kext. Our demo only uses the kext for adding a software bug. In a real world attack, you would just find an existing kernel bug. For our demo, we add our own bug to the kernel using a kext. PACMAN takes an existing software bug (memory read/ write) and turns it into a more powerful primitive (pointer authentication bypass). Why do you need a software bug to do the PACMAN attack? Neither of those things requires a kext- an attacker can find both in the vanilla kernel.Īn attacker with a software bug doesn’t need a kext. This kext does two things: 1) adds an artificial software bug to the kernel for us to attack, and 2) adds a PACMAN Gadget. You may be wondering why our attack begins by loading a custom kernel extension (kext). So, “ probably not.” Why are you loading a kext? Much like the Spectre attack our work is based on, PACMAN executes entirely in the speculative regime and leaves no logs. Can I tell if someone is using PACMAN against me? While the hardware mechanisms used by PACMAN cannot be patched with software features, memory corruption bugs can be. PACMAN is an exploitation technique- on its own it cannot compromise your system. Should I be worried?Īs long as you keep your software up to date, no.

PACMAN works just fine remotely if you have unprivileged code execution. Nope! We actually did all our experiments over the network on a machine in another room. Does this attack require physical access? PACMAN works across privilege levels, so it works on the kernel from user mode. Compromising the kernel means that an attacker can do anything you can do (eg. The kernel is the most privileged part of your computer’s operating system. PACMAN was discovered by researchers at MIT CSAIL. PACMAN also affects Neoverse V1, Neoverse N2, Cortex-A78C, Cortex-A78AE, Cortex-A710, Cortex-A715, Cortex-X1C, Cortex-X2, and Cortex-X3. We’ve shown PACMAN to work on the Apple M1 CPU.ĪRM has discovered many of its cores are also vulnerable to PACMAN.

For support questions, contact us at pacman-attackmitedu. We hope these tools will help the community perform next-generation microarchitectural research. PACMAN lies in the intersection of software and hardware attacks.įrom the beginning, PACMAN has been built with extensibility in mind.Īs part of our DEF CON 30 talk about PACMAN, we are releasing our proof-of-concept attack, as well as some in-house tools we built for researching Apple Silicon devices. We believe the core idea of PACMAN will be applicable to much more than just PAC. PACMAN is what you get when you mix a hardware mitigation for software attacks with microarchitectural side channels. A hardware attack to forge kernel PACs from userspace on M1.Reverse engineered details of the M1 memory hierarchy.A new way of thinking about compounding threat models in the Spectre age.PACMAN is a novel hardware attack that can bypass Pointer Authentication (PAC) on the Apple M1 CPU.

Pacman