AMD VM security tools can be bypassed, letting hackers infilitrate your devices, experts warn

Date:
Wed, 11 Dec 2024 23:03:00 +0000

Description:
Researchers found a way to access sensitive data on AMD devices using a Raspberry Pi Pico and physical access.

FULL STORY ======================================================================Universi ty researchers find way to trick AMD's secure VM tech into sharing sensitive information AMD released a security advisory with recommended mitigations The bug requires physical access, but in some scenarios could be abused through software alone

AMD Virtual Machine (VM) security tools can be bypassed, allowing cybercriminals to infiltrate devices and steal sensitive data, experts have warned.

Security researchers from multiple universities in the EU and the UK outlined how AMD chips come with Secure Encrypted Virtualization (SEV), a security feature designed to encrypt virtual machine (VM) memory to protect it from unauthorized access, including by the hypervisor or other VMs. SEV uses hardware-based encryption keys unique to each VM, ensuring data remains confidential and tamper-proof even in shared environments.

Recently, AMD upgraded SEV with Secure Nested Paging (SNP), an enhancement that should guarantee the integrity of a virtual machine's memory by validating memory page tables and preventing unauthorized modifications by
the hypervisor. However, the researchers claim SNP can be bypassed, if the attacker has physical access to the target device. They used a Raspberry Pi Pico to fake additional RAM, and exfiltrated secrets from it. They call the attack BadRAM. Attacks with and without hardware

By abusing the Serial Presence Detect (SPD) chip on the memorys module, they created aliases for physical memory, which they could later access.

"In our attacks, we double the apparent size of the Dual Inline Memory Module (DIMM) installed in the system to trick the CPU's memory controller into
using additional 'ghost' addressing bits," the researchers said in a research paper titled BadRAM: Practical Memory Aliasing Attacks on Trusted Execution Environments.

"These addressing bits will be unused within the virtually enlarged DIMM, creating an interesting aliasing effect where two different physical
addresses now refer to the same DRAM location."

The technique works on DDR4 and DDR5 memory, and theres even a possibility to use it without hardware, if the SPD chip is left unlocked (which, according
to The Register , is sometimes the case).

In response, AMD released a security advisory, and is now tracking the flaw
as CVE-2024-21944. It has gotten a severity score of 5.4 (medium). It recommends utilizing memory modules that lock SPD, as well as following physical security best practices. In addition, the AGESA and SEV FW versions listed below have been released to the Original Equipment Manufacturers (OEM) to mitigate this issue. Please refer to your OEM for the BIOS update specific to your product.

Further details can be found here .

Via The Register You might also like US government agency confirms it was
hit by major ransomware attack Here's a list of the best antivirus These are the best endpoint protection tools right now



======================================================================
Link to news story: https://www.techradar.com/pro/security/amd-vm-security-tools-can-be-bypassed-l etting-hackers-infilitrate-your-devices-experts-warn


--- Mystic BBS v1.12 A47 (Linux/64)
* Origin: tqwNet Technology News (1337:1/100)