Attacking the Golden Ring on AMD Mini-PC
In December 2019 AMD announced a release of a new product line- AMD MiniPc. This MiniPc is actually a direct competition to the well known Intel NUC and Gigabyte Brix. In this post I will show full research and exploitation for 1 of the 3 vulnerabilities I found in the UEFI image and reported to AMD. Specifically speaking all three vulnerabilities reside in SMM (Ring -2) code which is part of the UEFI image. SMM is the most privileged code that can execute on x86 CPU thus allowing to attack any low level component including Kernel and Hypervisor.
The vulnerability in this post allows arbitrary ‘write primitive’ to any location in SMRAM and as consequence execute attacker code in SMM mode. While executing in SMM I will show how it is possible to attack Windows Hypervisor and thus bypass HVCI -hypervisor code integrity. HVCI is a wonderful design and technology which eliminates any chance to run attacker code in Kernel mode. Some think that SMM vulnerabilities are not generic, this is actually not true, there are two major BIOS vendors -AMI and Phoenix that own huge amount of the code in any UEFI image no matter which CPU, Chipset, Motherboard this PC uses. Thanks much to Saar Amar and Alex Matrosov for reviewing the article. Good words also to AMD and ASRock for their fast response and quick fix release.
AMD -2020–0039 — Assigned as CVE-2020–14032; Severity High; 2/4/20 reported; 16/4/20 approved as vulnerability; 8/6/20 fixed version released.
AMD -2020–0040; Severity High; 2/4/20 reported; 16/4/20 approved as vulnerability; Not fixed yet.
AMD -2020–0041; Severity High; 2/4/20 reported; 16/4/20 approved as vulnerability; Not fixed yet.
https://medium.com/@dannyodler/attacking-the-golden-ring-on-amd-mini-pc-b7bfb217b437