Apple silicon vunrebility implications: GoFetch

Privacy Questions
1

Apple’s M2, and M3 chips are pretty common. The vulnerability “GoFetch” is an un-patchable vulnerability that can leak cryptographic keys.

Has anyone seen any write ups on how this could be used in real world attacks? So far it hasn’t been exploited. I skimmed the article and it seems like this exploit could leak encryption keys used for SSLs, communications, etc.

Does this exploit require physical access to the device, or can it be accessed remotely?

2

This is all stuff that pretty much needs laboratory* conditions to work, at least for the foreseeable future.

*just the right apps on just the right cores with just the right OS settings and nothing else interfering. As a normal user you don’t really have to worry about this until they manage to forge this into an exploit that can run from a website (which is extremely difficult)

3 Likes