So an attacker who needs to bypass PAC can already sometimes find a nonspeculative PAC bypass, though it’s hard. Assuming they can’t, maybe they can use this, i

So an attacker who needs to bypass PAC can already sometimes find a nonspeculative PAC bypass, though it’s hard. Assuming they can’t, maybe they can use this, if they can find and weaponize an appropriate gadget in the kernel. Sounds plausible but hard; maybe harder than finding a nonspeculative PAC bypass. Any speculative PAC bypass will also suffer from nondeterminism, so it’s not as practical for an attacker as a nonspeculative bypass. It’s not a given that the speculative PAC gadgets in any kernel are exploitable as effectively as the synthetic kext gadget in the paper. Even if you find a weaponizable PAC gadget in the kernel, and it actually gives you what you want, it’s not clear how reliable it’ll be in practice. So, this is kinda scary but it’s also a bit of theatre. The tech press will have something to write about though.