If exploited, these flaws can allow attackers to gain unauthorized access to sensitive information or generally cause problems
Recently information about a vulnerability was disclosed (already cataloged under CVE-2021-33164) detected in the UEFI firmware, the detected flaw allows executing code at the SMM (System Management Mode) level, which has a higher priority than hypervisor mode and protection ring zero, and provides unlimited access to all system memory.
The vulnerability, whose code name is RingHopper, is related to the possibility of a timing attack using DMA (Direct Memory Access) to corrupt memory in code running at the SMM layer.
A race condition involving SMRAM access and validation can be achieved by DMA timing attacks that depend on time-of-use (TOCTOU) conditions. An attacker can use timely polling to attempt to overwrite the contents of SMRAM with arbitrary data, leading to the attacker's code running with the same elevated privileges available to the CPU (ie, Ring -2 mode). The asynchronous nature of SMRAM access through DMA controllers allows an attacker to perform such unauthorized access and bypass the checks normally provided by the SMI controller API.
Intel-VT and Intel VT-d technologies provide some protection against DMA attacks by using the Input Output Memory Management Unit (IOMMU) to address DMA threats. Although IOMMU can protect against hardware DMA attacks, SMI controllers vulnerable to RingHopper can still be abused.
Vulnerabilities can be exploited from the operating system using SMI drivers vulnerable (System Administration Interrupt), which require administrator rights to access. The attack can also be done if there is physical access at an early stage of boot, at a stage prior to the initialization of the operating system. To block the issue, Linux users are recommended to update the firmware via the LVFS (Linux Vendor Firmware Service) using the fwupdmgr (fwupdmgr get-updates) utility from the fwupd package.
The need to have administrator rights to perform an attack limits the danger of the problem, but it does not prevent its use as a vulnerability of the second link, to maintain their presence after exploiting other vulnerabilities in the system or using social media engineering methods.
Access to SMM (Ring -2) allows code to be executed at a level that is not controlled by the operating system, which can be used to modify firmware and place malicious code or rootkits hidden in SPI Flash that are not detected by the operating system. , as well as to disable verification at the boot stage (UEFI Secure Boot, Intel BootGuard) and attacks on hypervisors to bypass the integrity verification mechanisms of virtual environments.
The problem is due to a race condition in the SMI controller (system management interrupt) that occurs between the access check and the SMRAM access. Side channel analysis with DMA can be used to determine the right time between the status check and the use of the check result.
As a result, due to the asynchronous nature of SMRAM access via DMA, an attacker can time and overwrite the contents of SMRAM via DMA, bypassing the SMI driver API.
Intel-VT and Intel VT-d enabled processors include protection against DMA attacks based on the use of IOMMU (Input Output Memory Management Unit), but this protection is effective in blocking hardware DMA attacks performed with prepared attack devices, and does not protect against attacks via SMI controllers.
The vulnerability has been confirmed in firmware Intel, Dell and Insyde Software (The issue is claimed to affect 8 manufacturers, but the remaining 5 have yet to be revealed.) the firmware of AMD, Phoenix and Toshiba are not affected by the problem.
Source: https://kb.cert.org/