AMD PSP: Firmware TPM Remote Code Execution via Crafted EK Certificate

Post by mjg59 » Fri, Jan 05, 2018, 9:08 PM UTC

userbinator wrote: post #2

AMD PSP is basically their equivalent to Intel's ME, so this is not surprising... but then it says This function is called from TPM2_CreatePrimary with user controlled data - a DER encoded [6] endorsement key (EK) certificate stored in the NV storage. If I understand correctly, this is related to SecureBoot and to do such operations with the keys and certificates, the user has to have physical access to the BIOS/UEFI…

Post by moosingin3space » Fri, Jan 05, 2018, 9:21 PM UTC

dogma1138 wrote: post #7

moosingin3space wrote: post #5

Earlier quoted context omitted.

I had read somewhere that AMD PSP does not have Internet access.

It does, DASH is also arguably much less secure than Intel's RMT.

Post by kakarot » Fri, Jan 05, 2018, 9:37 PM UTC

dogma1138 wrote: post #8

jkolem2 wrote: post #4

Earlier quoted context omitted.

I think Intel's ME is much more complex than AMD's PSP. Does anyone know if AMD's PSP has a full network stack and the ability to interact with network hardware independent of the main CPU's OS?

Yes, AMD's PSP runs a full OS which was made by Trustonic.

Post by dogma1138 » Fri, Jan 05, 2018, 9:46 PM UTC

kakarot wrote: post #16

dogma1138 wrote: post #8

Earlier quoted context omitted.

Yes, AMD's PSP runs a full OS which was made by Trustonic.

Trustonic is about as trustworthy a name as "Safecorp" or something similar. The name itself is just one big red flag.

Post by nasredin » Fri, Jan 05, 2018, 10:04 PM UTC

kakarot wrote: post #17

Tharkun wrote: post #15

Earlier quoted context omitted.

Hopefully 2018 will be the year where CPU manufacturers finally start taking security seriously.

Yeah sure and I bet this will be the year of the Linux Desktop, too.