Methods to disable Lockdown protection in Ubuntu for remote bypassing of UEFI Secure Boot

Andrei Konovalov from Google announced method for remote disabling of protection Lockdown, offered in the Linux kernel package provided in Ubuntu (theoretically proposed methods should work with the Fedora kernel and other distributions, but they have not been tested).

Lockdown restricts root user access to the kernel and blocks UEFI Secure Boot bypass paths. For example, in lockdown mode access to /dev/mem, /dev/kmem, /dev/port, /proc/kcore, debugfs, kprobes debug mode, mmiotrace, tracefs, BPF, PCMCIA CIS (Card Information Structure), some ACPI interfaces and CPU MSR registers is restricted; kexec_file and kexec_load calls are blocked, sleep mode is prohibited, DMA usage for PCI devices is limited, the import of ACPI code from EFI variables is not allowed, input/output port manipulations are forbidden, including changing the interrupt number and input/output port for the serial port.

The Lockdown mechanism was recently added to the mainline Linux kernel 5.4, but in the kernels provided in distributions, it is still implemented in the form of patches or supplemented with patches. One of the differences between the enhancements provided in distributions and the built-in kernel implementation is the ability to disable the provided lockdown when there is physical access to the system.

In Ubuntu and Fedora, the Alt+SysRq+X key combination is used to disable Lockdown. It is implied that the Alt+SysRq+X combination can only be used with physical access to the device, and in the case of a remote hack and gaining root access, the attacker will not be able to disable Lockdown and, for example, load an unsigned module with a rootkit into the kernel.

Andrei Konovalov demonstrated that keyboard-based methods to confirm the physical presence of a user are ineffective. The simplest way to disable Lockdown would be a software simulation of pressing Alt+SysRq+X via /dev/uinput, but this option is initially blocked. However, at least two more methods of substituting Alt+SysRq+X have been identified.

The first method is related to using the ‘sysrq-trigger’ interface — to simulate it, it is sufficient to enable this interface by writing ‘1’ to /proc/sys/kernel/sysrq, and then write ‘x’ to /proc/sysrq-trigger. The specified loophole has been closed in the December kernel update of Ubuntu and Fedora 31. Notably, the developers, as in the case with /dev/uinput, initially attempted to block this method, but the blocking did not work due to an error issues in the code.

The second method is related to keyboard emulation through USB/IP and subsequently sending the Alt+SysRq+X sequence from a virtual keyboard. The USB/IP support in the kernel shipped with Ubuntu is enabled by default (CONFIG_USBIP_VHCI_HCD=m and CONFIG_USBIP_CORE=m), and the necessary signed modules usbip_core and vhci_hcd are provided. An attacker can create a virtual USB device, by launching a network handler on the loopback interface and connecting it as a remote USB device using USB/IP. This method has been reported to the Ubuntu developers, but a fix has not yet been released.

Source: opennet.ru