Resources

People often ask me "How did you learn how to hack?" The answer: by reading. This page is a collection of the blog posts and other articles that I have accumulated over the years of my journey. Enjoy!

M1ssing Register Access Controls Leak EL0 State- 502

Hector MartinPosted 4 Years Ago
  • The Apple M1 is an apple computer (no iPhone) that runs on ARM. This was recently released and has been a hot topic for people.
  • This vulnerability is described as a covert channel between different processes running on the system. Instead of using the memory, sockets or files, an attacker could use this to remain under the radar.
  • The ARM system register s3_5_c15_c10_1 is directly accessible from EL0. This register contains two bits that can be read or written to (0 and 1). This is a per cluster register that can be accessed by all cores in a cluster. This creates a two bits convert challenge that can be used to send data across processes.
  • This vulnerability has little impact on the system. However, it is super interesting! This can only be fixed at a hardware level and only affects Apple M1 users.