Comment by wtallis
3 years ago
> An open system would have surfaced this bug long ago, possibly years ago (it's not clear how old this mistake is, but the claim seems to cover multiple Apple SOCs), and the vulnerable systems would have been limited to one version of the hardware that could feasibly have been replaced via warranty coverage or whatever.
How long did it take for Spectre and Meltdown to be discovered? Some vulnerabilities are easy to spot in an open design, but the more novel the exploit, the longer the vulnerability can hide in plain sight.
This isn't that novel though. They have the GPU set up to do cache snooping from the CPU without a protection mechanism[1] to prevent the CPU from stuffing dirty writeback entries on top of it for the GPU to see. That's not subtle or weird, and it doesn't represent a new category of attack. It's just a routine security whopper.
[1] On Intel, the IOMMU provides this. But just a cache that was aware of range-level protections (i.e. only allowed you to cache CPU-visible RAM from the CPU, etc...) would have worked.