Two side-channel attacks on Apple's M processors

An international team of cybersecurity researchers reports that it has discovered two security vulnerabilities in Apple's current M2 and M3 processors. Professor Yuval Yarom from Ruhr University Bochum was among those involved in the analyses.

The first vulnerability exploits features of the Load Value Predictor (LVP) introduced by Apple, which speeds up calculations by predicting work steps and anticipating the data to be loaded from memory. The processor performs calculations based on these predictions and compares its assumptions with the actual data as soon as it arrives. If its prediction turns out to be wrong, it discards the predicted results and recalculates with the correct data.

According to the research team, this process is prone to error: “If the LVP guesses incorrectly, the CPU can perform any calculations with incorrect data under speculative execution”. According to the team in a press release today (Wednesday), this allows critical checks in the program logic for memory security to be bypassed. The bypass in turn opens up attack surfaces for spying on data stored in the memory. According to the analysis published by the researchers in the technical paper “FLOP: Breaking the Apple M3 CPU via False Load Output Predictions”, attacks on web browsers are possible. The report from Ruhr University Bochum lists Safari and Chrome as examples. In principle, confidential data such as search histories, calendar entries and credit card details could be spied on.

The team found the second gap in Apple chips from the M2 and A15 series. It relates to the Load Address Predictor (LAP), which predicts the next memory address from which the CPU will retrieve data. If the prediction is incorrect, arbitrary calculations can be started: “This enables an end-to-end attack on the Safari browser,” explains the team. Attackers could use this to spy on browser activities. Email content retrieved from remote servers via HTTP (i.e., using the browser engine) could also fall into the wrong hands. The team describes the results of the LAP gap in the technical paper “SLAP: Data Speculation Attacks via Load Address Prediction on Apple Silicon”.

The vulnerabilities are found in the following Apple devices:

- all MacBooks built after 2022 (MacBook Air, MacBook Pro)

- all desktop Macs from 2023 onwards (Mac Mini, iMac, Mac Studio, Mac Pro)

- all iPad Pro, iPad Air and Mini models from September 2021 (iPad Pro 6th and 7th generation, iPad Air 6th generation, Mac Mini 6th generation)

- all iPhones since September 2021 (iPhone 13, 14, 15 and 16, iPhone SE 3)

The researchers already informed Apple's Product Security Team in May and September 2024 as part of the Responsible Disclosure, and also submitted the associated program code. Apple's team then requested that the results be withheld for longer than the usual 90 days. Until the publication of the two papers, Apple had not communicated a timetable for any countermeasures. The recently released operating system updates for macOS, iOS, and iPadOS do not appear to contain any countermeasures against SLAP and FLOP. In principle, a patch released by Apple on January 27 would be a possible solution. When asked by c't, Professor Yarom replied that this patch should be irrelevant for SLAP and FLOP. However, it can be expected that Apple will name the discoverers of the two loopholes as soon as they have been plugged. So far, there is no evidence that SLAP or FLOP are being used in the wild.

The researchers plan to present details of the vulnerabilities and attack methods to the professional audience at the renowned conferences IEEE SP 2025 (May 12-15, 2025 in San Francisco, USA) and USENIX Security 2025 (August 13-15, 2025 in Seattle, USA).

The team includes Jason Kim, Jalen Chuang and Daniel Genkin (all from the Georgia Institute of Technology) and Yuval Yarom. Yarom is Professor of Computer Security at the Faculty of Computer Science and the Horst Görtz Institute for IT Security at Ruhr-Universität Bochum and a member of the CASA Cluster of Excellence.

(dz)