GoFetch

GoFetch
The GoFetch project logo
Date discoveredprivately disclosed to Apple on 5 December 2023; 2 years ago (2023-12-05),[1] public announcement on 20 March 2024; 2 years ago (2024-03-20)[1]
DiscovererBoru Chen, Yingchen Wang, Pradyumna Shome, Christopher W. Fletcher, David Kohlbrenner, Riccardo Paccagnella, Daniel Genkin
Affected hardwareApple silicon CPUs (M1, M2, M3 and A14)
Websitehttps://gofetch.fail/

GoFetch is a family of cryptographic attacks on some Apple silicon chips that exploits the CPU's on-chip data memory-dependent prefetcher (DMP) to investigate the contents of memory.[2][1]

Attacks

Chips affected include the M1, M2, M3 and A14 series systems-on-a-chip.[1]

The DMP looks at cache memory content for possible pointer values and prefetches the data at those locations into cache if it sees memory access patterns suggesting that following those pointers would be useful.[3][4] The GoFetch attacks use those speculative cache fetches to undermine a number of different cryptographic algorithms by using memory access timings to exfiltrate data from those algorithms using timing attacks.

The authors of GoFetch state that they were unable to make their exploit work on the Intel Raptor Lake processor, which they tested due to its more limited DMP functionality.[1]

References

  1. ^ a b c d e "GoFetch: Breaking Constant-Time Cryptographic Implementations Using Data Memory-Dependent Prefetchers". gofetch.fail. Retrieved 2024-03-22.
  2. ^ "Apple Silicon chip flaw can leak encryption keys, say researchers". AppleInsider. 2024-03-21. Retrieved 2024-03-22.
  3. ^ "Augury: Using Data Memory-Dependent Prefetchers to Leak Data at Rest". www.prefetchers.info. 2022-05-02. Retrieved 2024-03-30.
  4. ^ Vicarte, Jose Rodrigo Sanchez; Flanders, Michael; Paccagnella, Riccardo; Garrett-Grossman, Grant; Morrison, Adam; Fletcher, Christopher W.; Kohlbrenner, David (May 2022). Augury: Using Data Memory-Dependent Prefetchers to Leak Data at Rest. 2022 IEEE Symposium on Security and Privacy (SP). San Francisco, CA, USA: IEEE. pp. 1491–1505. doi:10.1109/SP46214.2022.9833570. ISBN 978-1-6654-1316-9.

Content Disclaimer

Informasi ini disarikan dari Wikipedia dan disajikan kembali untuk tujuan edukasi. Konten tersedia di bawah lisensi CC BY-SA 3.0. Kami tidak bertanggung jawab atas ketidakakuratan data yang bersumber dari kontribusi publik tersebut.

  1. The information displayed on this website is sourced in part or in whole from Wikipedia and has been adapted for the purpose of restating it. We strive to provide accurate and relevant information, however:
  2. There is no guarantee of absolute accuracy. Wikipedia is an open, collaborative project that can be edited by anyone, so information is subject to change.
  3. It is not intended to constitute professional advice. The content displayed is for informational and educational purposes only. For important decisions (e.g., medical, legal, or financial), please consult a professional.
  4. Content copyright. Wikipedia is licensed under the Creative Commons Attribution-ShareAlike License (CC BY-SA). This means that content may be reused with appropriate attribution and shared under a similar license.
  5. Responsible use. Any risk arising from the use of information from this website is entirely the responsibility of the user.