gofetch.fail

What It Is

GoFetch is a microarchitectural side-channel attack study published at USENIX Security 2024. Its core finding is that Data Memory-Dependent Prefetchers (DMPs) may treat “pointer-like” data in memory as potential addresses and prefetch them. This effectively mixes data and addresses at the hardware level, undermining the assumptions behind constant-time programming. The researchers demonstrated end-to-end key extraction on Apple m1 against OpenSSL Diffie-Hellman, Go RSA, and CRYSTALS-Kyber and Dilithium, and noted that m2 and m3 exhibit similarly exploitable behavior.

Core Capabilities and Security Perspective

In terms of protection category, GoFetch is not a firewall, EDR, or vulnerability scanner. It is attack research, vulnerability disclosure, and a PoC. Its value lies in helping cryptographic library developers and hardware security teams understand the side-channel risks introduced by DMPs. For deployment, the site provides the paper, demo videos, and GitHub proof-of-concept code, but there is no commercial console, agent, or SaaS offering. Management and alerting capabilities are also not present. The recommended mitigations mainly include keeping software updated, setting the DIT/DOIT bit on certain CPUs, applying input blinding for some schemes, and preventing attacker and victim processes from sharing hardware.

Pricing and Compliance

The material does not provide any pricing, licensed sales, or enterprise support information, nor does it mention compliance certifications. The site’s logo is available under a CC0 license, but that is not the same as a security product license. The PoC and paper are better suited as materials for research, auditing, and internal risk assessment.

Pros and Cons

The main strengths are the depth of the technical disclosure: it explains the conflict between DMPs, cache side channels, and constant-time programming, and provides affected processor details and mitigation paths. It also covers both classical and post-quantum cryptographic implementations, making it highly relevant in practice. The downsides are the high barrier to practical use: determining whether a specific implementation is affected requires cryptographic analysis and code review; disabling DMP on m1/m2 under macOS is still constrained by kernel support; and it does not provide continuous monitoring, alerting, or vendor-grade services.

Who It’s For and Access from China

GoFetch is suitable for cryptographic library maintainers, chip and system security researchers, cloud platform security teams, and organizations handling high-value keys on Apple Silicon. For ordinary enterprises that need immediate protection, the priority should be software updates, hardware isolation, dedicated instances, and cryptographic library audits. The source text does not provide information on access from China; domain reachability and payment methods are unknown. Alternatives include side-channel security audits, cryptographic implementation assessment tools, vendor security advisory tracking, and hardware isolation strategies.