Initial AMD Technical Assessment of CTS Labs Research

by Hilbert Hagedoorn on: 03/21/2018 08:05 AM | source: | 29 comment(s)

AMD now officially responded to the existence of the bugs related to its Ryzen processors, exactly one week after the existence of the security problems have been made public by CTS labs. The CTO states it has been able to reproduce the mentioned issues in the security processor and the chipset developed by ASMedia.

BIOS updates and firmware patches are on the way, also for PSP. The PSP is an ARM core integrated in AMD processors that enables remote management, similar to the Intel Management Engine.

--- AMD---

On March 12, 2018, AMD received a communication from CTS Labs regarding research into security vulnerabilities involving some AMD products. Less than 24 hours later, the research firm went public with its findings.

Security and protecting users’ data is of the utmost importance to us at AMD and we have worked rapidly to assess this security research and develop mitigation plans where needed. This is our first public update on this research, and will cover both our technical assessment of the issues as well as planned mitigation actions.

The security issues identified by the third-party researchers are not related to the AMD “Zen” CPU architecture or the Google Project Zero exploits made public Jan. 3, 2018. Instead, these issues are associated with the firmware managing the embedded security control processor in some of our products (AMD Secure Processor) and the chipset used in some socket AM4 and socket TR4 desktop platforms supporting AMD processors. As described in more detail below, AMD has rapidly completed its assessment and is in the process of developing and staging the deployment of mitigations.

It’s important to note that all the issues raised in the research require administrative access to the system, a type of access that effectively grants the user unrestricted access to the system and the right to delete, create or modify any of the folders or files on the computer, as well as change any settings. Any attacker gaining unauthorized administrative access would have a wide range of attacks at their disposal well beyond the exploits identified in this research. Further, all modern operating systems and enterprise-quality hypervisors today have many effective security controls, such as Microsoft Windows Credential Guard in the Windows environment, in place to prevent unauthorized administrative access that would need to be overcome in order to affect these security issues. A useful clarification of the difficulties associated with successfully exploiting these issues can be found in this posting from Trail of Bits, an independent security research firm who were contracted by the third-party researchers to verify their findings.

The security issues identified can be grouped into three major categories. The table below describes the categories, the AMD assessment of impact, and planned actions.

Vulnerability Groups

Problem Description & Method of Exploitation

Potential Impact

Planned AMD Mitigation

MASTERKEY

and

PSP Privilege Escalation

(AMD Secure Processor or “PSP” firmware)

Issue: Attacker who already has compromised the security of a system updates flash to corrupt its contents. AMD Secure Processor (PSP) checks do not detect the corruption.

Method: Attacker requires Administrative access

Attacker can circumvent platform security controls. These changes are persistent following a system reboot.

Firmware patch release through BIOS update. No performance impact is expected.

AMD is working on PSP firmware updates that we plan to release in the coming weeks.

RYZENFALL and FALLOUT

(AMD Secure Processor firmware)

Issue: Attacker who already has compromised the security of a system writes to AMD Secure Processor registers to exploit vulnerabilities in the interface between x86 and AMD Secure Processor (PSP).

Method: Attacker requires Administrative access.

Attacker can circumvent platform security controls but is not persistent across reboots.

Attacker may install difficult to detect malware in SMM (x86).

Firmware patch release through BIOS update. No performance impact is expected.

AMD is working on PSP firmware updates that we plan to release in the coming weeks.

“Promotory”
Chipset

CHIMERA

“Promontory” chipset used in many socket AM4 desktop and socket TR4 high-end desktop (HEDT) platforms.

AMD EPYC server platforms, EPYC and Ryzen Embedded platforms, and AMD Ryzen Mobile FP5 platforms do not use the “Promontory” chipset.

Issue: Attacker who already has compromised the security of a system installs a malicious driver that exposes certain Promontory functions.

Method: Attacker requires Administrative access.

Attacker accesses physical memory through the chipset.

Attacker installs difficult to detect malware in the chipset but is not persistent across reboots.

Mitigating patches released through BIOS update. No performance impact is expected.

AMD is working with the third-party provider that designed and manufactured the “Promontory” chipset on appropriate mitigations.

AMD will provide additional updates on both our analysis of these issues and the related mitigation plans in the coming weeks.

Related Stories

AMD Radeon Pro Duo (Dual Fiji GPUs) Announced + Initial Perf Numbers - 03/15/2016 07:30 PM
Read it well, an announcement, don't expect any reviews. We do have some photo's though. The DUal Fiji GPU based AMD Radeon Pro Duo has been announced. Imagine two Fury X cards and well, there you ...

AMD Mantle Update - Driver released to press - Initial Results - 02/01/2014 10:55 AM
I promised to keep you guys up-to date. AMD has released a Mantle active driver to the press hours ago. So it will not be ling before the first results will appear. The driver apparently will with in ...

6 pages 1 2 3 4 5 6

Prince Valiant
Senior Member

Posts: 811
Joined: 2014-02-23

#5530119 Posted on: 03/21/2018 04:14 PM

AMD got security research done for free :p?

AsiJu
Senior Member

Posts: 8233
Joined: 2010-10-16

#5530130 Posted on: 03/21/2018 04:42 PM

AMD professionally "defused" the situation by calmly and collectively responding. Very nice work.

And, this was already mentioned above but I'll quote it anyway from the response:

"It’s important to note that all the issues raised in the research require administrative access to the system, a type of access that effectively grants the user unrestricted access to the system and the right to delete, create or modify any of the folders or files on the computer, as well as change any settings.
Any attacker gaining unauthorized administrative access would have a wide range of attacks at their disposal well beyond the exploits identified in this research."

I said in another thread that should the above happen, possible exploit vectors are the least of your worries.

waltc3
Senior Member

Posts: 1433
Joined: 2014-07-22

#5530171 Posted on: 03/21/2018 06:21 PM

It's sad AMD even needs to respond to the trolls who were only interested in bringing down the stock for short selling. It wouldn't surprise me if that CTS Labs had been taken down by now, and the dudes behind it were already looking for their next victim, ready to found a new whatever cover company for the purpose.

It's sad that seemingly everything that appears on the Internet, if not fake news, is given a level of credibility completely undeserved. To sum up from the company hired by "CTS" to supposedly verify their blatantly ignorant, financially motivated claims:

There is no immediate risk of exploitation of these vulnerabilities for most users. Even if the full details were published today, attackers would need to invest significant development efforts to build attack tools that utilize these vulnerabilities. This level of effort is beyond the reach of most attackers (see https://www.usenix.org/system/files/1401-08-12-mickens.pdf, Figure 1)

These types of vulnerabilities should not surprise any security researchers; similar flaws have been found in other embedded systems that have attempted to implement security features. They are the result of simple programming flaws, unclear security boundaries, and insufficient security testing. In contrast, the recent Meltdown and Spectre flaws required previously unknown techniques and novel research advances to discover and exploit.

I think CTS had best have written its own obituary as opposed to AMD's.... This would be a nice undertaking for the SEC.

Rich_Guy
Senior Member

Posts: 12947
Joined: 2003-05-11

#5530176 Posted on: 03/21/2018 06:33 PM

so AMDs confirmed it, and are going to start patching within weeks, lol.

TLD LARS
Senior Member

Posts: 490
Joined: 2017-03-01

#5530193 Posted on: 03/21/2018 07:06 PM

so AMDs confirmed it, and are going to start patching within weeks, lol.

Yes they confirmed it because you can attack the computer if you have admin rights, but if you have admin rights anyway you could just attack windows itself and not limit your attack to AMD only.
I am guessing here, but i think that Asus and Asrock is now busy applying the AMD fixes to the Asmedia chips installed on many Asus and Asrock Intel boards.

Many of these attacks could effect Intel also, if you have the skills it should be possible to mod a Intel bios, to compromise a Intel system.
They managed to install a 8000 i3 CPU in a 100 series chipset motherboard by modding the bios, so modding to compromise a system should be possible.

6 pages 1 2 3 4 5 6

Post New Comment

Click here to post a comment for this news story on the message forum.