Applying the Principle of Least Privilege to System Management Interrupt Handlers with the Intel SMI Transfer Monitor

ABSTRACT

Recent years have seen a growing concern over System Management Mode (SMM) and its broad access to platform resources. The SMI Transfer Monitor (STM) is Intel’s most powerful executing CPU context. The STM is a firmware-based hypervisor that applies the principle of least privilege to powerful System Management Interrupt (SMI) handlers that control runtime firmware. These handlers have traditionally had full access to memory as well as the register state of applications and kernel code even when their functionality did not require it. The STM has been been enabled for UEFI and, most recently, coreboot firmware, adding protection against runtime SMM-based attacks as well as establishing a firmware-based Trusted Execution Environment (TEE) capability. We provide a detailed overview of the STM architecture, evaluate its protections, and quantify its performance. Our results show the STM can protect against published SMM vulnerabilities with tolerable performance overheads.

References

1. Ahmed M. Azab and et al. Ning, Peng. 2014. Hypervision Across Worlds: Real-time Kernel Protection from the ARM TrustZone Secure World. In Proceedings of the 2014 ACM SIGSAC Conference on Computer and Communications Security (Scottsdale, Arizona, USA) (CCS ’14). ACM, New York, NY, USA, 90–102. https://doi.org/10.1145/2660267.2660350
2. Ahmed M. Azab, Peng Ning, Zhi Wang, Xuxian Jiang, Xiaolan Zhang, and Nathan C. Skalsky. 2010. HyperSentry: Enabling Stealthy In-context Measurement of Hypervisor Integrity. In Proceedings of the 17th ACM Conference on Computer and Communications Security (Chicago, Illinois, USA) (CCS ’10). ACM, New York, NY, USA, 38–49. https://doi.org/10.1145/1866307.1866313
3. Sandrine Bailleux. 2018. Secure Partitions. OSFC.
4. Ronny Chevalier, Maugan Villatel, David Plaquin, and Guillaume Hiet. 2017. Co-processor-based Behavior Monitoring: Application to the Detection of Attacks Against the System Management Mode. In Proceedings of the 33rd Annual Computer Security Applications Conference (Orlando, FL, USA) (ACSAC 2017). ACM, New York, NY, USA, 399–411. https://doi.org/10.1145/3134600.3134622
5. Cr4sh. 2016. Thinkpwn. https://github.com/Cr4sh/ThinkPwn
6. Al Danial. 2020. CLOC. https://github.com/AlDanial/cloc
7. Brian Delgado and Karen L. Karavanic. 2013. Performance implications of System Management Mode. In 2013 IEEE International Symposium on Workload Characterization (IISWC). 163–173. https://doi.org/10.1109/IISWC.2013.6704682
8. Brian Delgado, Tejaswini Vibhute, John Fastabend, and Karen Karavanic. 2019. EPA-RIMM: An Efficient, Performance-Aware Runtime Integrity Measurement Mechanism for Modern Server Platforms. In 2019 49th Annual IEEE/IFIP International Conference on Dependable Systems and Networks (DSN). IEEE, 422–434.
9. Loıc Duflot, Daniel Etiemble, and Olivier Grumelard. 2006. Using CPU system management mode to circumvent operating system security functions. CanSecWest/core06 (2006).
10. Jake Edge. 2010. Enabling Intel TXT in Fedora. https://lwn.net/Articles/382077/
11. Infosec Institute. 2014. Hooking System Calls Through MSRs. (2014). https://resources.infosecinstitute.com/hooking-system-calls-msrs
12. Intel. 2015. SMI Transfer Monitor (STM) User Guide.
13. Intel. 2020. Intel® 64 and IA-32 Architectures Software Developer’s Manual (Vol. 3).
14. Corey Kallenberg, John Butterworth, Xeno Kovah, and C Cornwell. 2013. Defeating signed bios enforcement. EkoParty, Buenos Aires(2013).
15. Corey Kallenberg and Xeno Kovah. 2015. How Many Million BIOSes Would you Like to Infect?CanSecWest, Vancouver, Canada.
16. Dayeol Lee, David Kohlbrenner, Shweta Shinde, Krste Asanovic, and Dawn Song. 2020. Keystone: An Open Framework for Architecting Trusted Execution Environments. In Proceedings of the Fifteenth European Conference on Computer Systems(EuroSys ’20).
17. Tony Lo. 2016. Tailoring TrustZone as SMM Equivalent. UEFI PlugFest. http://www.uefi.org/sites/default/files/resources/UEFI_Plugfest_March_2016_AMI.pdf
18. John Loucaides and Yuriy Bulygin. 2014. Platform Security Assessment with CHIPSEC. https://cansecwest.com/slides/2014/Platform.
19. Ijlal Loutfi.2019. SMMDecoy: Detecting GPU Keyloggers using Security by Deception Techniques. In Proceedings of the 5th International Conference on Information Systems Security and Privacy - Volume 1: ICISSP,. INSTICC, SciTePress, 580–587.
20. Shangcong Luan. 2016. Exploit Two Xen Hypervisor Vulnerabilities. (2016). BlackHat 2016.
21. Keith Mannthey. 2009. System Management Interrupt Free Hardware. http://linuxplumbersconf.org/2009/slides/Keith-Mannthey-SMIplumers-2009.pdf
22. Alex Matrosov. 2017. Who Watch BIOS Watchers?https://medium.com/@matrosov/bypass-intel-boot-guard-cc05edfca3a9
23. Alex Matrosov, Eugene Rodionov, and Sergey Bratus. 2019. Rootkits and bootkits: reversing modern malware and next generation threats. No Starch Press.
24. Saeid Mofrad, Fengwei Zhang, Shiyong Lu, and Weidong Shi. 2018. A Comparison Study of Intel SGX and AMD Memory Encryption Technology. In Proceedings of the 7th International Workshop on Hardware and Architectural Support for Security and Privacy(HASP ’18). ACM, New York, NY, USA.
25. Eugene D. Myers. 2018. Using the Intel STM for Protected Execution. http://www.platformsecuritysummit.com/2018/speaker/myers/STMPE2Intelv84a.pdf
26. Joshua Schiffman and David Kaplan. 2014. The smm rootkit revisited: Fun with usb. In 2014 Ninth International Conference on Availability, Reliability and Security. IEEE, 279–286.
27. TianoCore. 2019. UEFI Variable Runtime Cache. https://github.com/tianocore/tianocore.github.io/wiki/UEFI-Variable-Runtime-Cache
28. TianoCore. 2020. 8. SMRAM Overwrite in SmmVariableHandler. https://edk2-docs.gitbook.io/security-advisory/smram_overwrite_in_smmvariablehandler
29. TianoCore. 2020. EDK II Secure Code Review Guide. https://edk2-docs.gitbook.io/edk-ii-secure-code-review-guide/code_review_guidelines_for_boot_firmware/hardware_input
30. Josh Triplett and Bert Tripplet. 2011. BITS: BIOS Implementation Test Suite. http://www.linuxplumbersconf.org/2011/ocw/system/presentations/867/original/bits.pdf.
31. Liam Tung. 2018. Ex-Intel security expert: This new Spectre attack can even reveal firmware secrets. https://www.zdnet.com/article/ex-intel-security-expert-this-new-spectre-attack-can-even-reveal-firmware-secrets/
32. Tejaswini Vibhute. 2018. EPA-RIMM-V: Efficient Rootkit Detection for Virtualized Environment. Master’s thesis. Portland State University.
33. Jiang Wang, Angelos Stavrou, , and Anup Ghosh. 2010. HyperCheck: A Hardware-assisted Integrity Monitor. In Proceedings of the 13th International Conference on Recent Advances in Intrusion Detection (Ottawa, Ontario, Canada) (RAID’10). Springer-Verlag, Berlin, Heidelberg, 158–177. http://dl.acm.org/citation.cfm?id=1894166.1894178
34. Rafal Wojtczuk and Joanna Rutkowska. 2009. Attacking SMM memory via Intel CPU cache poisoning. Invisible Things Lab(2009), 16–18.
35. Jiewen Yao. 2016. [edk2] [PATCH V2 0/6] Enable SMM page level protection..https://lists.01.org/pipermail/edk2-devel/2016-November/004185.html
36. Jiewen Yao, Vincent Zimmer, and Star Zeng. 2016. A Tour Beyond BIOS Secure SMM Communication in the EFI Developer Kit II. Technical Report. Intel.
37. Fengwei Zhang, Kevin Leach, Kun Sun, and Angelos Stavrou. 2013. SPECTRE: A Dependable Introspection Framework via System Management Mode. In Proceedings of the 2013 43rd Annual IEEE/IFIP International Conference on Dependable Systems and Networks (DSN)(DSN ’13). IEEE Computer Society, Washington, DC, USA, 1–12. https://doi.org/10.1109/DSN.2013.6575343

Index Terms

• Security and privacy

  • Systems security

    • Operating systems security

• Social and professional topics

  • Computing / technology policy

    • Computer crime

• Software and its engineering

  • Software organization and properties

    • Contextual software domains

      • Operating systems