AMD PSP: Firmware TPM Remote Code Execution via Crafted EK Certificate
1–10 of 99 posts
Re: AMD PSP: Firmware TPM Remote Code Execution via Crafted EK Certificate
#2AMD PSP is basically their equivalent to Intel's ME, so this is not surprising... but then it says
This function is called from TPM2_CreatePrimary with user controlled data - a DER encoded [6] endorsement key (EK) certificate stored in the NV storage.
If I understand correctly, this is related to SecureBoot and to do such operations with the keys and certificates, the user has to have physical access to the BIOS/UEFI setup already, correct?
Re: AMD PSP: Firmware TPM Remote Code Execution via Crafted EK Certificate
#3AMD PSP is basically their equivalent to Intel's ME, so this is not surprising... but then it says This function is called from TPM2_CreatePrimary with user controlled data - a DER encoded [6] endorsement key (EK) certificate stored in the NV storage. If I understand correctly, this is related to SecureBoot and to do such operations with the keys and certificates, the user has to have physical access to the BIOS/UEFI…
TPM's are supposed to be resistant to physical attacks.
With this flaw, someone can just stick a bootable USB stick in your computer to mirror the LUKS/bitlocker disk drive and get access to the keys in the TPM which protect that drive.
Re: AMD PSP: Firmware TPM Remote Code Execution via Crafted EK Certificate
#4AMD PSP is basically their equivalent to Intel's ME, so this is not surprising... but then it says This function is called from TPM2_CreatePrimary with user controlled data - a DER encoded [6] endorsement key (EK) certificate stored in the NV storage. If I understand correctly, this is related to SecureBoot and to do such operations with the keys and certificates, the user has to have physical access to the BIOS/UEFI…
I think Intel's ME is much more complex than AMD's PSP. Does anyone know if AMD's PSP has a full network stack and the ability to interact with network hardware independent of the main CPU's OS?
Re: AMD PSP: Firmware TPM Remote Code Execution via Crafted EK Certificate
#5AMD PSP is basically their equivalent to Intel's ME, so this is not surprising... but then it says This function is called from TPM2_CreatePrimary with user controlled data - a DER encoded [6] endorsement key (EK) certificate stored in the NV storage. If I understand correctly, this is related to SecureBoot and to do such operations with the keys and certificates, the user has to have physical access to the BIOS/UEFI…
I think Intel's ME is much more complex than AMD's PSP. Does anyone know if AMD's PSP has a full network stack and the ability to interact with network hardware independent of the main CPU's OS?
I had read somewhere that AMD PSP does not have Internet access.
Re: AMD PSP: Firmware TPM Remote Code Execution via Crafted EK Certificate
#6AMD PSP is basically their equivalent to Intel's ME, so this is not surprising... but then it says This function is called from TPM2_CreatePrimary with user controlled data - a DER encoded [6] endorsement key (EK) certificate stored in the NV storage. If I understand correctly, this is related to SecureBoot and to do such operations with the keys and certificates, the user has to have physical access to the BIOS/UEFI…
TPM's are supposed to be resistant to physical attacks. With this flaw, someone can just stick a bootable USB stick in your computer to mirror the LUKS/bitlocker disk drive and get access to the keys in the TPM which protect that drive.
For discrete TPMs the specification explicitly says that they are not required to be resistant to physical attacks (probably because that would require specifying what kinds of attacks it is supposed to be resistant to).
Re: AMD PSP: Firmware TPM Remote Code Execution via Crafted EK Certificate
#7Earlier quoted context omitted.
I think Intel's ME is much more complex than AMD's PSP. Does anyone know if AMD's PSP has a full network stack and the ability to interact with network hardware independent of the main CPU's OS?
I had read somewhere that AMD PSP does not have Internet access.
It does, DASH is also arguably much less secure than Intel's RMT.
Re: AMD PSP: Firmware TPM Remote Code Execution via Crafted EK Certificate
#8AMD PSP is basically their equivalent to Intel's ME, so this is not surprising... but then it says This function is called from TPM2_CreatePrimary with user controlled data - a DER encoded [6] endorsement key (EK) certificate stored in the NV storage. If I understand correctly, this is related to SecureBoot and to do such operations with the keys and certificates, the user has to have physical access to the BIOS/UEFI…
I think Intel's ME is much more complex than AMD's PSP. Does anyone know if AMD's PSP has a full network stack and the ability to interact with network hardware independent of the main CPU's OS?
Yes, AMD's PSP runs a full OS which was made by Trustonic.
Re: AMD PSP: Firmware TPM Remote Code Execution via Crafted EK Certificate
#9AMD PSP is basically their equivalent to Intel's ME, so this is not surprising... but then it says This function is called from TPM2_CreatePrimary with user controlled data - a DER encoded [6] endorsement key (EK) certificate stored in the NV storage. If I understand correctly, this is related to SecureBoot and to do such operations with the keys and certificates, the user has to have physical access to the BIOS/UEFI…
The PSP is already quite long in the tooth. I think AMD will switch to ARM's recently announced "SecurCore" soon, just like Qualcomm did for the Snapdragon 845:
https://developer.arm.com/products/processors/cortex-m/sc300...
Re: AMD PSP: Firmware TPM Remote Code Execution via Crafted EK Certificate
#10I think "remote" here means "host to TPM chip". Which is still bad, but not on the level of "install a rootkit on a powered-off machine" like some of the Intel ME exploits.