PACMAN: Attacking ARM Pointer Authentication with Speculative Execution

Memory corruption vulnerabilities have resulted in numerous exploits and significant damage to computer systems. ARM Pointer Authentication is a memory mitigation that attempts mitigate these issues by cryptographically signing pointers at runtime. We present PACMAN, novel attack methodology can forge correct pointer signatures bypass the protection of without causing any crashes using microarchitectural side channels. PACMAN removes primary barrier conducting control-flow hijacking attacks on platform protected with Authentication. built two proof concept showing works across privilege levels Apple M1 CPU. also released suite open-source tools enable community perform future research Silicon devices.