{"id":120977,"date":"2024-12-13T21:46:00","date_gmt":"2024-12-13T19:46:02","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/ataka-badram-pozvolyayushhaya-obojti-mehanizm-attestaczii-sev-snp-v-cpu-amd"},"modified":"2024-12-13T21:46:00","modified_gmt":"2024-12-13T19:46:02","slug":"ataka-badram-pozvolyayushhaya-obojti-mehanizm-attestaczii-sev-snp-v-cpu-amd","status":"publish","type":"post","link":"https:\/\/prohoster.info\/en\/blog\/news\/ataka-badram-pozvolyayushhaya-obojti-mehanizm-attestaczii-sev-snp-v-cpu-amd","title":{"rendered":"BadRAM attack, which allows bypassing the SEV-SNP attestation mechanism in AMD CPUs","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"
A group of researchers from the University of Leuven, the University of L\u00fcbeck, and the University of Birmingham has developed a BadRAM attack method (CVE-2024-21944) that allows bypassing the authentication mechanism and compromising environments protected by the SEV-SNP extension in AMD processors. To execute this attack, the attacker, with few exceptions, must gain physical access to the memory modules and also have the ability to execute code at ring 0 on the server running the protected guest environments. <\/p>\n
AMD SEV (Secure Encrypted Virtualization) extensions aim to provide guarantees for the memory integrity of virtual machines, as well as to protect them from tampering and analysis by the host system administrator capable of executing code at the hypervisor level. Initially, AMD SEV protection was limited to encrypting the contents of the guest system's memory and isolating registers, but later, in AMD EPYC processors, the SEV-SNP (Secure Nested Paging) extension was implemented to safely handle nested memory page tables, ensuring memory integrity and preventing changes to the guest system's memory by the hypervisor. <\/p>\n
The AMD SEV-SNP mechanism was created to prevent intelligence agencies or data center and cloud provider personnel, where protected guest systems operate, from interfering with the guest system's operation. The proposed BadRAM attack method allows bypassing the provided guarantees by altering the SPD (Serial Presence Detect) metadata in DDR4 or DDR5 memory modules. If the attack is successful, the attacker can overwrite the encrypted data in the guest system\u2019s memory (at the ciphertext level, without the ability to decrypt) and circumvent the attestation mechanism, for example, to conceal the injection of a backdoor into a virtual machine protected by SEV-SNP technology. <\/p>\n
The attack is based on setting up fake parameters in the SPD of the memory module, causing the processor to access non-existent addresses reflected in existing memory areas. The attacker can adjust the SPD so that the memory module reports a size that exceeds the actual characteristics of the module. After this, the attacker can map the fabricated non-existent memory to a real area in the DRAM, which is already being used in an encrypted form in secure guest systems. As a result, a situation arises where different addresses point to the same physical memory (two areas are reflected in one area in the DRAM chip), meaning that the address of the fake reflected memory area can access already used real memory and bypass the memory protection mechanisms in the CPU.
<\/center> <\/p>\n
To carry out the attack, it is enough to assemble a simple programmer costing about $10, consisting of a Raspberry Pi Pico microcontroller, a socket for DDR4 \/ DDR5 modules, and a power supply. The utilities used to perform the attack, the kernel module, and exploit prototypes are hosted on GitHub.
<\/center> <\/p>\n
For chips from certain manufacturers that do not have SPD rewrite protection, the attack can be performed programmatically without physical access to the server. For example, the parameters of Corsair memory modules with RGB lighting can be changed programmatically. In the case of a fully software-based attack, the system can be compromised, for instance, through the use of a malicious BIOS update or through sabotage by administrators. servers<\/a> in cloud services.
![\"BadRAM](\"\/wp-content\/uploads\/2024\/12\/4713140e7aea99a59554abc7ddf71360.png\")
<\/center> <\/p>\n![\"BadRAM](\"\/wp-content\/uploads\/2024\/12\/d688956f05643a91bf1b5881d80af66a.jpg\")
<\/center> <\/p>\n![\"BadRAM](\"\/wp-content\/uploads\/2024\/12\/3ee9c7a2287c41ac8e0f237106f58e2c.png\")
<\/center> <\/p>\n![\"Play](\"https:\/\/img.youtube.com\/vi\/AUKR0Q5xWW8\/hqdefault.jpg\")
\r\n ![\"Play](\"https:\/\/img.youtube.com\/vi\/zhDACoigQ9M\/hqdefault.jpg\")
\r\n