Information has been revealed about a vulnerability (CVE-2021-33164) in UEFI firmware that allows code execution at the SMM (System Management Mode) level, which is higher in priority than the hypervisor mode and zero protection ring, providing unrestricted access to all system memory. The vulnerability, codenamed RingHopper, is related to the possibility of a timing attack using DMA (Direct Memory Access) to corrupt memory in the code executed at the SMM level. The presence of the vulnerability has been confirmed in the firmware of Intel, Dell, and Insyde Software (it is claimed that the problem affects 8 manufacturers, but the other 5 have not yet been disclosed). AMD, Phoenix, and Toshiba firmware are not affected by the issue.
Exploitation of the vulnerabilities can be carried out from the operating system using vulnerable SMI handlers (System Management Interrupt), which require administrator rights for access. An attack can also be conducted if physical access is available early in the boot process, before the operating system is initialized. To mitigate the issue, Linux users are advised to update the firmware using the LVFS (Linux Vendor Firmware Service), utilizing the fwupdmgr tool (fwupdmgr get-updates; fwupdmgr update) from the fwupd package.
The necessity of having administrator rights to carry out an attack limits the danger of the problem, but does not prevent its use as a second-tier vulnerability, to maintain presence after exploiting other vulnerabilities in the system or using social engineering methods. Access to SMM (Ring -2) allows code execution at a level not controlled by the operating system, which can be used to modify firmware and insert hidden malware or rootkits into SPI Flash that are undetectable by the operating system, as well as to disable verification at the boot stage (UEFI Secure Boot, Intel BootGuard) and attack hypervisors to bypass integrity checking mechanisms in virtual environments.
Problemet orsakas av ett tillstÄnd av tÀvling i SMI (System Management Interrupt) hanteraren, som uppstÄr vid tiden mellan Ätkomstkontroll och tillgÄng till SMRAM. För att bestÀmma den nödvÀndiga tidpunkten mellan statuskontroll och anvÀndning av kontrollresultatet kan analys av sidokanaler med hjÀlp av DMA anvÀndas. Som ett resultat av den asynkrona naturen av Ätkomsten till SMRAM via DMA kan en angripare identifiera den nödvÀndiga tidpunkten och skriva över innehÄllet i SMRAM, genom att anvÀnda DMA förbi SMI hanterarens API. Processorer som stöder Intel-VT och Intel VT-d mekanismer inkluderar skydd mot DMA-attacker, baserat pÄ anvÀndningen av IOMMU (Input-Output Memory Management Unit), men detta skydd Àr effektivt för att blockera hÄrdvarubaserade DMA-attacker genom förberedda angriparens enheter, och skyddar inte mot attacker genom SMI hanterare.
KĂ€lla: opennet.ru
