Academic researchers recently uncovered a significant security concern with Apple’s M-series chips that could potentially impact the security of Mac devices. This vulnerability allows attackers to extract secret encryption keys, posing a threat to the confidentiality of sensitive data.

Unlike typical software vulnerabilities that can be patched directly, this flaw is deeply embedded in the microarchitecture of Apple silicon, making it unpatchable through traditional methods. To address this issue, third-party cryptographic software must incorporate defenses to mitigate the risk.

The flaw exploits a side channel in the chips’ data memory-dependent prefetcher, a hardware optimization that predicts memory addresses of upcoming data access. This vulnerability affects both older and newer generations of Apple’s M-series chips, including the popular M1 and M2 models.

Dubbed “GoFetch” by researchers, this attack can be executed by regular applications without requiring root access, making it accessible to most third-party software installed on macOS systems. By operating within the same user privileges as ordinary applications, GoFetch can extract secret keys from cryptographic operations.

The exploitation process is intricate and time-consuming, with extraction times varying based on the complexity and length of the encryption key. While Apple has not yet commented on this vulnerability, users and developers are understandably concerned about its potential impact on device security.

As developers work towards addressing this issue, implementing defenses against such attacks may result in performance penalties, affecting the efficiency of cryptographic operations on affected devices. Stay tuned for updates as experts continue to navigate this evolving security landscape.