{"id":{"repo_id":"mit","oai_identifier":"oai:dspace.mit.edu:1721.1/152860"},"canonical_url":"https://search.dev.ndltd.org/etd/mit/oai:dspace.mit.edu:1721.1/152860","repository":{"repo_id":"mit","name":"MIT","base_url":"https://dspace.mit.edu/oai/request"},"display":{"title":"Discovering Novel Microarchitectural Security Vulnerabilities in Modern Processors","abstract":"For decades, computer security issues such as viruses, worms, and Trojans have caused significant damages to computer systems across the world. Many of these security issues are caused by vulnerabilities in software allowing for memory corruption, a kind of attack where the contents of a computer’s memory are corrupted by an attacker to change a program’s behavior. While much research has been done on how to improve software security, vendors are increasingly turning to hardware defenses to compensate for software vulnerabilities. One such example is ARM Pointer Authentication, a security feature that enforces pointer integrity through the use of cryptographic hashes. I will introduce the PACMAN attack, a novel attack methodology that defeats Pointer Authentication by leveraging the behavior of the CPU’s microarchitecture. I will present multiple proof-of-concept attacks showing PACMAN defeating Pointer Authentication on the Apple M1 SoC, the world’s first desktop processor that supports Pointer Authentication. I will also document the tools I have created to perform detailed reverse engineering of the microarchitecture on Apple Silicon platforms, enabling both this work and future research. I will also present two memory corruption vulnerabilities I have discovered and reported in modern operating systems as case studies of the kind of software vulnerability Pointer Authentication tries to mitigate. The first is an uninitialized memory issue in Linux, and the second is a race condition leading to a type confusion in XNU. Finally, I will present a series of classroom exercises I have created to teach students about CPU vulnerabilities like PACMAN.","abstract_html":"For decades, computer security issues such as viruses, worms, and Trojans have caused significant damages to computer systems across the world. Many of these security issues are caused by vulnerabilities in software allowing for memory corruption, a kind of attack where the contents of a computer’s memory are corrupted by an attacker to change a program’s behavior. While much research has been done on how to improve software security, vendors are increasingly turning to hardware defenses to compensate for software vulnerabilities. One such example is ARM Pointer Authentication, a security feature that enforces pointer integrity through the use of cryptographic hashes. I will introduce the PACMAN attack, a novel attack methodology that defeats Pointer Authentication by leveraging the behavior of the CPU’s microarchitecture. I will present multiple proof-of-concept attacks showing PACMAN defeating Pointer Authentication on the Apple M1 SoC, the world’s first desktop processor that supports Pointer Authentication. I will also document the tools I have created to perform detailed reverse engineering of the microarchitecture on Apple Silicon platforms, enabling both this work and future research. I will also present two memory corruption vulnerabilities I have discovered and reported in modern operating systems as case studies of the kind of software vulnerability Pointer Authentication tries to mitigate. The first is an uninitialized memory issue in Linux, and the second is a race condition leading to a type confusion in XNU. Finally, I will present a series of classroom exercises I have created to teach students about CPU vulnerabilities like PACMAN.","abstract_has_math":false,"creators":["Ravichandran, Joseph"],"institution":"Massachusetts Institute of Technology","degree_name":"Master","degree_level":null,"degree_discipline":null,"degree_department":"Massachusetts Institute of Technology. Department of Electrical Engineering and Computer Science","school":null,"contributors":[],"advisors":["Yan, Mengjia"],"committee_chairs":[],"committee_members":[],"year":2023,"date_issued":"2023-09","date_published":"2023-09","updated_at":"2026-07-22T22:21:24Z","subjects":[],"languages":[],"rights":["In Copyright - Educational Use Permitted","Copyright retained by author(s)"],"rights_urls":["https://rightsstatements.org/page/InC-EDU/1.0/"],"identifier_entries":[]},"links":{"outbound_url":"https://hdl.handle.net/1721.1/152860","outbound_label":"Handle","outbound_source":"dc:identifier.uri"},"metadata_groups":[{"id":"people","label":"People","entries":[{"key":"dc:contributor.advisor","label":"Advisor","values":["Yan, Mengjia"]},{"key":"dc:contributor.department","label":"Department","values":["Massachusetts Institute of Technology. Department of Electrical Engineering and Computer Science"]},{"key":"dc:creator","label":"Author","values":["Ravichandran, Joseph"]}]},{"id":"academic_context","label":"Academic Context","entries":[{"key":"dc:date.accessioned","label":"Dc Date Accessioned","values":["2023-11-02T20:22:58Z"]},{"key":"dc:date.available","label":"Dc Date Available","values":["2023-11-02T20:22:58Z"]},{"key":"dc:date.issued","label":"Date","values":["2023-09"]},{"key":"dc:publisher","label":"Institution","values":["Massachusetts Institute of Technology"]},{"key":"dc:type","label":"Dc Type","values":["Thesis"]},{"key":"thesis:degree_name","label":"Degree Name","values":["Master","Master of Science in Electrical Engineering and Computer Science"]}]},{"id":"language_rights","label":"Language and Rights","entries":[{"key":"dc:rights","label":"Dc Rights","values":["In Copyright - Educational Use Permitted","Copyright retained by author(s)"]},{"key":"dc:rights.uri","label":"Rights URI","values":["https://rightsstatements.org/page/InC-EDU/1.0/"]}]},{"id":"identifiers","label":"Identifiers","entries":[{"key":"dc:identifier.uri","label":"Identifier URI","values":["https://hdl.handle.net/1721.1/152860"]}]},{"id":"additional","label":"Additional Metadata","entries":[{"key":"dc:description.abstract","label":"Abstract","values":["For decades, computer security issues such as viruses, worms, and Trojans have caused significant damages to computer systems across the world. Many of these security issues are caused by vulnerabilities in software allowing for memory corruption, a kind of attack where the contents of a computer’s memory are corrupted by an attacker to change a program’s behavior. While much research has been done on how to improve software security, vendors are increasingly turning to hardware defenses to compensate for software vulnerabilities. One such example is ARM Pointer Authentication, a security feature that enforces pointer integrity through the use of cryptographic hashes. I will introduce the PACMAN attack, a novel attack methodology that defeats Pointer Authentication by leveraging the behavior of the CPU’s microarchitecture. I will present multiple proof-of-concept attacks showing PACMAN defeating Pointer Authentication on the Apple M1 SoC, the world’s first desktop processor that supports Pointer Authentication. I will also document the tools I have created to perform detailed reverse engineering of the microarchitecture on Apple Silicon platforms, enabling both this work and future research. I will also present two memory corruption vulnerabilities I have discovered and reported in modern operating systems as case studies of the kind of software vulnerability Pointer Authentication tries to mitigate. The first is an uninitialized memory issue in Linux, and the second is a race condition leading to a type confusion in XNU. Finally, I will present a series of classroom exercises I have created to teach students about CPU vulnerabilities like PACMAN."]},{"key":"dc:description.degree","label":"Dc Description Degree","values":["S.M."]},{"key":"dc:title","label":"Title","values":["Discovering Novel Microarchitectural Security Vulnerabilities in Modern Processors"]}]}],"canonical_facts":{"dc:contributor.advisor":["Yan, Mengjia"],"dc:contributor.department":["Massachusetts Institute of Technology. Department of Electrical Engineering and Computer Science"],"dc:creator":["Ravichandran, Joseph"],"dc:date.accessioned":["2023-11-02T20:22:58Z"],"dc:date.available":["2023-11-02T20:22:58Z"],"dc:date.issued":["2023-09"],"dc:description.abstract":["For decades, computer security issues such as viruses, worms, and Trojans have caused significant damages to computer systems across the world. Many of these security issues are caused by vulnerabilities in software allowing for memory corruption, a kind of attack where the contents of a computer’s memory are corrupted by an attacker to change a program’s behavior. While much research has been done on how to improve software security, vendors are increasingly turning to hardware defenses to compensate for software vulnerabilities. One such example is ARM Pointer Authentication, a security feature that enforces pointer integrity through the use of cryptographic hashes. I will introduce the PACMAN attack, a novel attack methodology that defeats Pointer Authentication by leveraging the behavior of the CPU’s microarchitecture. I will present multiple proof-of-concept attacks showing PACMAN defeating Pointer Authentication on the Apple M1 SoC, the world’s first desktop processor that supports Pointer Authentication. I will also document the tools I have created to perform detailed reverse engineering of the microarchitecture on Apple Silicon platforms, enabling both this work and future research. I will also present two memory corruption vulnerabilities I have discovered and reported in modern operating systems as case studies of the kind of software vulnerability Pointer Authentication tries to mitigate. The first is an uninitialized memory issue in Linux, and the second is a race condition leading to a type confusion in XNU. Finally, I will present a series of classroom exercises I have created to teach students about CPU vulnerabilities like PACMAN."],"dc:description.degree":["S.M."],"dc:identifier.uri":["https://hdl.handle.net/1721.1/152860"],"dc:publisher":["Massachusetts Institute of Technology"],"dc:rights":["In Copyright - Educational Use Permitted","Copyright retained by author(s)"],"dc:rights.uri":["https://rightsstatements.org/page/InC-EDU/1.0/"],"dc:title":["Discovering Novel Microarchitectural Security Vulnerabilities in Modern Processors"],"dc:type":["Thesis"],"thesis:degree_name":["Master","Master of Science in Electrical Engineering and Computer Science"]},"updated_at":"2026-07-22T22:21:24Z"}