[ad_1]
Apple’s new M1 A developer discovered a flaw in the CPU, which created a covert channel that two or more installed malicious applications can use to transmit information to each other.
Secret communication can happen without using computer memory, sockets, files or any other operating system functions. Developers Hector Martin Say. Channels can bridge processes running under different user identities and different permission levels. These features allow applications to exchange data in ways that cannot be detected—or at least without specialized equipment.
Martin said this defect is mainly harmless because it cannot be used to infect Mac And it cannot be used by vulnerabilities or malicious software to steal or tamper with the data stored on the machine. On the contrary, the vulnerability can only be abused by two or more malicious applications that have been installed on the Mac in a way unrelated to the M1 vulnerability.
Nevertheless, this vulnerability, which Martin called M1racles, fits the technical definition VulnerabilityTherefore, it carries its own vulnerability name: CVE-2021-30747.
“It violates the operating system security model,” Martin explained in an article. Posts published on Wednesday“You should not be able to secretly send data from one process to another. Even if it is harmless in this case, you should not be able to write random CPU system registers from user space.”
Other researchers with expertise in CPU and other silicon-based security agree with this assessment.
“The errors found cannot be used to infer information about any application on the system,” said Michael Schwartz, one of the researchers who helped find more serious vulnerabilities. Crash and ghost Vulnerabilities in Intel, AMD and ARM CPUs. “It can only be used as a communication channel between two colluding (malicious) applications.”
He went on to elaborate:
The vulnerability is similar to an anonymous “post office mailbox”, which allows two applications to send messages to each other. This is more or less invisible to other applications, and there is no effective way to prevent it. However, since no other applications are using this “post office box”, there is no leakage of data or metadata from other applications. Therefore, there is a restriction that it can only be used as a communication channel between two applications running on macOS. However, there are already many communication methods for applications (files, pipes, sockets, etc.), and one more channel will not really have a negative impact on security. Nevertheless, this is an error that can be abused as an accidental communication channel, so I think it is fair to call it a loophole.
Martin said that the covert channel may have a greater impact on the iPhone because it can be used to bypass the sandbox built into the iOS application. Under normal circumstances, malicious keyboard applications cannot leak keystrokes because such applications cannot access the Internet. Covert channels can bypass this protection by passing the key to another malicious application, which in turn sends it over the Internet.
Even so, the possibility that the two applications will pass Apple’s review process and then be installed on the target device is slim.
The defect stems from each cluster system register in the ARM CPU, which can be passed through EL0, A mode reserved for user applications and therefore has limited system permissions. This register contains two bits that can be read or written. This creates a covert channel because the register can be accessed simultaneously by all cores in the cluster.
Martin wrote:
A pair of malicious cooperative processes may construct a robust channel from this two-bit state by using clock and data protocols (for example, write 1x on one side to send data, and write 00 on the other side to request the next bit). This allows processes to exchange any amount of data, limited only by CPU overhead. The CPU core correlation API can be used to ensure that both processes are scheduled on the same CPU core cluster.PoC showing this method of achieving high-speed and robust data transmission is available HereThis method does not require much optimization, and can achieve a transmission rate of more than 1MB/s (less data redundancy).
[ad_2]
Source link
