• Abstract and Figures
• Public Full-text

IOMMU protection against I/O attacks: A vulnerability and a proof-of-concept Benoît Morgan, Eric Alata, Vincent Nicomette, Mohamed Kaâniche To cite this version: Benoît Morgan, Eric Alata, Vincent Nicomette, Mohamed Kaâniche. IOMMU protection against I/O attacks: A vulnerability and a proof-of-concept. Journal of the Brazilian Computer Society, Springer Verlag, 2018, 24, pp.Article number: 2. 10.1186/s13173-017-0066-7. hal-02877143 HAL Id: hal-02877143 https://hal.archives-ouvertes.fr/hal-02877143 Submitted on 22 Jun 2020 HAL is a multi-disciplinary open access L’archive ouverte pluridisciplinaire HAL, est archive for the deposit and dissemination of sci- destinée au dépôt et à la diffusion de documents entific research documents, whether they are pub- scientifiques de niveau recherche, publiés ou non, lished or not. The documents may come from émanant des établissements d’enseignement et de teaching and research institutions in France or recherche français ou étrangers, des laboratoires abroad, or from public or private research centers. publics ou privés. Morgan et al. RESEARCH IOMMU protection against I/O attacks: A vulnerability and a proof-of-concept Beno^ıtMorgan1,2*, Eric´ Alata1,2, Vincent Nicomette1,2 and Mohamed Ka^aniche1 performance levels and hardware services, more so- phisticated architectures have emerged with multiple input/output communication channels. In particular, normalized communication buses have been specified Abstract to allow tier manufacturers to complement bare ar- I/O attacks have received increasing attention chitectures with complex peripherals. Then, to relieve during the last decade. These attacks are the host processor from performing certain data copies performed by malicious peripherals that make read and operations, DMA cycles have been added to these or write accesses to DRAM memory or to memory external buses, allowing peripherals to perform read- embedded in other peripherals, through DMA /write accesses to other peripherals and RAM memory (Direct Memory Access) requests. Some protection segments. These communication channels raise serious mechanisms have been implemented in modern security concerns as they offer opportunities to attack- architectures to face these attacks. A typical ers to corrupt the system and the hosted applications example is the IOMMU (Input Output Memory using some malicious peripherals. To cope with such Management Unit). However, such mechanisms attacks, also called I/O attacks, some hardware pro- may not be properly configured and used by the tection components, such as the IOMMU, have been firmware and the operating system. This paper included in modern computers. describes a design weakness that we discovered in In order to really take advantage of these security the configuration of an IOMMU and a possible components, they have to be properly configured and exploitation scenario that would allow a malicious activated by the firmware and the kernel at boot time. peripheral to bypass the underlying protection The security of the boot process is crucial, as weakness mechanism. The exploitation scenario is at this stage may lead to a serious security flaw, de- implemented for Intel architectures, with a PCI spite the reliable design of these components. To the Express peripheral FPGA, based on Intel best of our knowledge, the security of the boot pro- specifications and Linux source code analysis. cess has not been thoroughly investigated in the liter- Finally, as a proof of concept, a Linux rootkit ature. This paper focusses on the security analysis of based on the attack presented in this paper is the IOMMU activation process at boot time. In par- implemented. ticular, it is shown, that even if this component has Keywords: Security; IOMMU; Firmware; Linux; been introduced 10 years ago, some serious security Vulnerability; Attack concerns may be raised about its actual efficiency to prevent malicious I/O attacks. Briefly, this paper high- lights a novel attack scenario that is related to the fact that the IOMMU configuration tables are initialized in 1 Introduction a DRAM region which is not protected from DMA Historically, early personal computers and their pe- at startup. As a consequence, a malicious peripheral ripherals were mostly designed and built by the same may modify these tables just before the activation of company. The peripherals used to be much less com- the IOMMU by the hardware. To illustrate the feasibil- plex than today (microcode, firmwares, etc.) and the ity of this scenario, a proof-of-concept is implemented processor manufacturers used to trust the peripher- and presented in this paper. als. However, with the increasing demand for higher A preliminary description of the vulnerabilities and *Correspondence: [email protected] the exploitation scenario of the IOMMU was presented 1Laboratoire d'Analyse et d'Architecture des Syst`emes(LAAS-CNRS), 7 in [1]. In this paper, more technical details are pro- avenue du Colonel Roche, 31400 Toulouse, France 2INSA Toulouse, 135 avenue de Rangueil, 31400 Toulouse, France vided, in particular, regarding the related work, the Full list of author information is available at the end of the article description of the proof-of-concept, and the experi- Morgan et al. Page 2 of 10 ment carried out to illustrate the IOMMU vulnera- CPU bility and its exploitation. The potential impact of the Host bridge identified vulnerability and the main limitations are {0x0; 0xfff} [00:00.0] RAM also discussed. Endpoint Endpoint This paper is organized as follows. The next two DMAR 0 DMAR 2 [01:00.0] [00.01.0] Sections describe fundamental components of the ar- {0x1000; 0x1fff} DMAR 1 {0x2000; 0x2fff} {01:yy.z} chitecture involved in the identified design weakness. {0x1000; 0x1fff} RAM data Root Complex Section 2 presents some basic technical background RAM read command about PCI Express bus and communications that are {02-03:yy.z} Read(0xffc, 03:00.0) {0x3000; 0x4fff} Switch Read completion (03:00.0, 00:00.0) used to perform DMA, while Section 3 presents the {addr1; addr2} Device address range IOMMU component as well as some of its internals, {xx:yy.z} Bridge id range {02:yy.z} {03:yy.z} that are necessary for the reader to understand the {0x3000; 0x3fff} {0x4000; 0x4fff} vulnerability and its potential exploitation. Section 4 Endpoint Endpoint briefly presents some examples of I/O attacks. Section [02:00.0] [03:00.0] 5 describes the vulnerability that we discovered in the {0x3000; 0x3fff}{0x4000; 0x4fff} configuration of the IOMMU and a scenario illustrat- Figure 1 Memory read message routing ing its possible exploitation. Section 7 proposes some countermeasures to cope with this vulnerability. Fi- nally, Section 8 concludes and discusses future work. contains a destination address and a device requester 2 Technical background id: the destination of the corresponding memory read This section presents basic background concepts re- completion (response) is the associated requester id. lated to the PCI Express bus and communications that PCI Express messages are therefore routed by address are useful to understand the rest of the paper. or id. To route the messages correctly, the bridges are configured by the host to know which ids and mem- 2.1 PCI Express bus ory ranges are responsible for downstream communica- Several bus specifications like Industry Standard tions. Figure 1 illustrates the routing of a memory read Architecture or Peripheral Component Interconnect message targetting address 0xffc from device 03:00.0 (PCI) have been implemented to support the com- and its associated completion from the host bridge to munications between the CPU and the peripherals. the requester device. Today, the PCI Express bus is used in most personal At boot time, the devices are not yet configured and computers and servers. There are three main types they do not know their own identifier. Indeed, the of PCI Express devices. The root of the bus hierar- manufacturer does not know the bus on which the chy, called the root complex, is connected to the CPU device will be plugged. However, when the firmware thanks to the host bridge and to first level PCI Ex- looks for all available devices (using the assembler in- press children devices. These devices can be endpoints struction mov to read the PCI Express space mapped (so-called peripherals in the paper) and bridges. A in memory), each memory access is processed by the bridge connects two different logical bus domains with host bridge. The host bridge then translates this ac- an upstream and a downstream port. cess into a PCI Express configuration request which is routed to the corresponding bus. In particular, this 2.2 Communications request contains the identifier of the contacted device. Each PCI Express device is identified with a PCI log- ical bus, a device and a function identifier (id), noted If this device is available in the system, it receives this bus:dev.fun. This identification is used to route PCI request and then knows its identifier. This step is im- Express messages between devices. portant to allow a device to communicate. The receiver of a message is either identified by its PCI Express peripherals are able, through DMA re- identifier or by an address. Thus, an address has two quests, to access other peripheral memories and the purposes. Either, it corresponds to an element in the main RAM, even in the kernel memory regions, with- main memory and the memory controller redirects the out any control of the processor. This raises a major corresponding access to the DRAM or it corresponds security concerns if the peripheral is controlled by an to a register of another device and the memory con- attacker. To mitigate this threat, Intel has integrated troller redirects the corresponding access to the device. the IOMMU hardware component, to filter PCI Ex- In the latter case, the registers of the device are said press messages. This component is presented in the memory mapped.

Load more

  11

Copy Link