Looks like AMD's ROM Armor feature was made public. This feature is direct result of our research. Hugo and myself discovered race condition in AMD's chipset. Rather than doing proper coordinated disclosure AMD marketed their fix it as a new feature. bit.ly/3qmvbcJ 🧵
It is similar to Intel's SpeedRacer vulnerability. When chipset receives SMI# signal it unlocks SPI controller but there is no guarantee all threads entered SMM. So we have a small time window to sneak commands directly to SPI BAR.
Since this vulnerability permanently exists in their hardware they disabled access to SPI controller from Ring0 and SMM and moved all SPI related operations to PSP for which Hugo found bunch of bypasses and credited in recent #PatchTuesday
Since AMD taking security seriously and never told you about this I recommend updating your BIOS and enabling ROM Armor if you are running on AMD hardware. Image
Bonus points: Vuln is triggerable from DMA for which I wrote a PoC using their own CCP DMA engine. By default SPI contorller doesn't lock SPI flash at all and you can use Flashrom to flash your backdoors on AMD platforms.
Oh and we never got credited or received CVE for this work since we disclosed this vulnerability to them in summer 2019.

• • •

Missing some Tweet in this thread? You can try to force a refresh
 

Keep Current with Volodymyr Pikhur

Volodymyr Pikhur Profile picture

Stay in touch and get notified when new unrolls are available from this author!

Read all threads

This Thread may be Removed Anytime!

PDF

Twitter may remove this content at anytime! Save it as PDF for later use!

Try unrolling a thread yourself!

how to unroll video
  1. Follow @ThreadReaderApp to mention us!

  2. From a Twitter thread mention us with a keyword "unroll"
@threadreaderapp unroll

Practice here first or read more on our help page!

Did Thread Reader help you today?

Support us! We are indie developers!


This site is made by just two indie developers on a laptop doing marketing, support and development! Read more about the story.

Become a Premium Member ($3/month or $30/year) and get exclusive features!

Become Premium

Too expensive? Make a small donation by buying us coffee ($5) or help with server cost ($10)

Donate via Paypal

Thank you for your support!

Follow Us on Twitter!

:(