US researchers have reported discovering a hardware chip vulnerability inside Apple M1, M2, and M3 silicon chips. The unpatchable ‘GoFetch’ is a microarchitecture vulnerability and side channel attack that reportedly affects all kinds of encryption algorithms, even the 2,048 bit keys that are hardened to protect against attacks from quantum computers.
This serious vulnerability renders uselss the security effects of constant time programming, a side channel mitigation encryption algorithm. This means that encryption software can be tricked by applications using GoFetch into putting sensitive data into the cache so it can be stolen.
Pending any fix advice from Apple, users are recommended to use the latest versions of software, and to perform updates regularly. Also, developers of cryptographic libraries should set the DOIT bit and DIT bit to disable the DMP on some CPUs, and to use input blinding (cryptography). Users are also recommended to avoid hardware sharing to help maintain the security of cryptographic protocols.
