The PACMAN Attack: Breaking Pointer Authentication on Apple M1 with Hardware Attacks

The Role of Pointer Authentication (PAC) on Apple Silicon

ARM Pointer Authentication (PAC) uses cryptographic signatures on memory pointers to detect and prevent memory corruption and control-flow hijacking attacks.

Merging Microarchitectural Side Channels with Software Exploitation

Joseph Ravichandran presents PACMAN, a novel attack methodology that uses speculative execution to leak PAC authentication results without crashing the target process.

Brute-Forcing Cryptographic PAC Signatures Silently

Ravichandran demonstrates using cache side channels (Prime+Probe) to guess valid pointer signatures across kernel and user space memory.

Implications for Hardware Security Architecture

The author discusses why software mitigations cannot fully fix hardware microarchitectural leaks and proposes next-generation CPU design improvements.