人在日本的資安專家 Hector Martin 找到了 Apple M1 的安全漏洞，可以不用透過 macOS Big Sur 提供的界面，直接透過 M1 的漏洞跨使用者權限傳輸資料，這可以用在突破 sandbox 的限制。而也如同目前的流行，他取了一個好記的名字：「M1RACLES: M1ssing Register Access Controls Leak EL0 State」，對應的 CVE 是 CVE-2021-30747。
先講比較特別的點，PoC 的影片放在 YouTube 上，作者拿 Bad Apple!! 當作示範，這很明顯是個雙關的點：
這應該是當年的影繪版本，看了好懷念啊... 當年看到的時候有種「浪費才能」的感覺，但不得不說是個經典。
在 Hacker News 上有討論可以翻翻：「M1racles: An Apple M1 covert channel vulnerability (m1racles.com)」。
依照作者的說明，Apple A14 因為架構類似，也有類似的問題，不過作者沒有 iPhone，沒辦法實際測試：
Are other Apple CPUs affected?
Maybe, but I don't have an iPhone or a DTK to test it. Feel free to report back if you try it. The A14 has been confirmed as also affected, which is expected, as it is a close relative of the M1.
另外作者覺得這個安全漏洞在 macOS 上還好，主要是你系統都已經被打穿可以操控 s3_5_c15_c10_1 register 了，應該會有更好的方式可以用：
So you're telling me I shouldn't worry?
Yes.
What, really?
Really, nobody's going to actually find a nefarious use for this flaw in practical circumstances. Besides, there are already a million side channels you can use for cooperative cross-process communication (e.g. cache stuff), on every system. Covert channels can't leak data from uncooperative apps or systems.
Actually, that one's worth repeating: Covert channels are completely useless unless your system is already compromised.
比較明顯的問題應該是 iOS 這邊的 privacy issue，不過 iOS 上的 app store 有基本的保護機制：(不過想到作者可以故意寫成 RCE 漏洞...)
What about iOS?
iOS is affected, like all other OSes. There are unique privacy implications to this vulnerability on iOS, as it could be used to bypass some of its stricter privacy protections. For example, keyboard apps are not allowed to access the internet, for privacy reasons. A malicious keyboard app could use this vulnerability to send text that the user types to another malicious app, which could then send it to the internet.
However, since iOS apps distributed through the App Store are not allowed to build code at runtime (JIT), Apple can automatically scan them at submission time and reliably detect any attempts to exploit this vulnerability using static analysis (which they already use). We do not have further information on whether Apple is planning to deploy these checks (or whether they have already done so), but they are aware of the potential issue and it would be reasonable to expect they will. It is even possible that the existing automated analysis already rejects any attempts to use system registers directly.
