We found a way to defeat pointer authentication (and forge kernel pointers from userspace) on the Apple M1 via a new hardware attack.

Here’s how it works-https://t.co/6Kz3jnRtwI

— Joseph Ravichandran (@0xjprx) June 10, 2022