Physical Flaws: Intel's Root-of-Trust Issue Mostly Mitigated

Most Intel processors produced in the past five years have a vulnerability in the component of the chip responsible for securely executing security services, threatening the system's so-called root of trust, warns Positive Technologies.

Intel fixed the vulnerability in the Intel Converged Security and Management Engine (CSME) in May 2019 and updated its guidance in February, but it has not released enough details for companies to assess their risk, says Mark Ermolov, lead specialist of operating system and hardware security at Positive Technologies. The security firm has produced a proof-of-concept attack for the flaw but will not release it yet, he says.

"The worst-case scenario is that a hacker gains access to the chipset key, which would enable him to access all information stored on the computer, encrypted or otherwise, and even run a keylogger on Intel CSME to track everything a victim types into the affected computer," Ermolov says. "Exploitation is difficult but possible. Most importantly, now, in order to get the root key, you do not need multimillion-dollar equipment or much time. Using this vulnerability, a qualified specialist can get the master key in just a few hours using only software tools and then do whatever he wants with this system."

The severity of the vulnerability remains to be seen. Because the CSME is the root of critical security functions on the system — handling encryption and secure boot — a compromised system, and the information on that system, can no longer be trusted.

On unpatched systems, an attacker who already compromised the operating system could exploit the issue, assigned CVE-2019-0090, in the Intel CSME to undermine the system's fundamental security. For patched system, only physical access will allow such a compromise. Yet the vulnerability itself cannot be patched because it's in the hardware and part of the chip's architecture, says Ermolov, who considers the issue worse than the speculative execution flaws Spectre and Meltdown.

"Since this is a hardware vulnerability, the situation cannot be fixed with updates," he says. "Intel has issued a mitigation, which greatly complicates the attack but does not make it impossible."

Intel considered the flaw to be critical but, with patching, not a risk for companies. Intel acknowledged the issue, but highlighted the fact that patched systems that are not run in Intel Manufacturing Mode — an undocumented execution mode meant for manufacturers to test their systems — can only be attacked at the keyboard. 

"Intel recommends that end users adopt best security practices by installing updates as soon as they become available and being continually vigilant to detect and prevent intrusions and exploitations," the company said in a statment sent to Dark Reading. "End users should maintain physical possession of their platform."

Security researchers have heavily scrutinized Intel's CSME because compromising the hardware allows the security of a system to be undermined at a fundamental level. Two years ago, a collection of researchers published two attacks, Meltdown and Spectre, that took advantage of the speculative execution of Intel processors to allow attackers to gain access to any information flowing through the hardware. Since then, at least six other similar flaws have been found.

In reaction to the vulnerabilities, Intel has committed to putting security first and has recently published an analysis of all the 236 vulnerabilities reported in 2019. Two Intel security experts also discussed the companies approach to securing the CSME during a talk at the 2019 Black Hat Security Conference.

Postive Technologies has focused on Intel's Management Engine and, now, Intel's Converged Security and Management Engine. In 2017, the company found a stack overflow bug in the Intel ME that could be used by insiders and supply chain attackers to gain and retain total control of a system. 

With the latest vulnerability, Positive Technologies researchers focused on the input-output memory management unit (IOMMU), finding that the boot order of the devices allowed external drivers to gain control of execution too early to ensure secure booting. 

"Researchers found that there is a very big bug: The IOMMU is activated too late after x86 paging structures were created and initialized," Ermolov says. "Only Intel can mitigate all of known exploitations vectors by blocking all integrated devices that are known to have DMA [direct memory access] capabilities [to the CSME]." 

Positive Technologies found it could exploit the issue through the Integrated Sensors Hub. Intel's patch has closed that vector, eliminating any current way of exploiting the bug using local code execution — that is, after an attacker has already compromised the system.

"Intel blocked ISH [Integrated Sensors Hub], so now it can't issue DMA transactions to the CSME," Ermolov says. "But we're convinced there other exploitation vectors, and they will be found soon."

Related Content:

Check out The Edge, Dark Reading's new section for features, threat data, and in-depth perspectives. Today's top story: "The Perfect Travel Security Policy for a Globe-Trotting Laptop."