Bypass kernel lockdown/UEFI secure boot on Ubuntu 18.04 with ACPI SSDT injection
1–10 of 33 posts
Re: Bypass kernel lockdown/UEFI secure boot on Ubuntu 18.04 with ACPI SSDT injection
#2What is SSDT? What's exactly going on in this exploit?
Re: Bypass kernel lockdown/UEFI secure boot on Ubuntu 18.04 with ACPI SSDT injection
#3Requires the ability to edit information in /boot and to reboot, so effectively root access but it does circumvent secure boot.
Re: Bypass kernel lockdown/UEFI secure boot on Ubuntu 18.04 with ACPI SSDT injection
#4Requires the ability to edit information in /boot and to reboot, so effectively root access but it does circumvent secure boot.
The idea of secure boot is to have a security level above root. So that even if you gain root level access, you can't put an APT onto the box or similar.
Re: Bypass kernel lockdown/UEFI secure boot on Ubuntu 18.04 with ACPI SSDT injection
#5What is SSDT? What's exactly going on in this exploit?
Refer to https://uefi.org/specifications
> ACPI defines many tables that provide the interface between an ACPI-compliant operating system, and system firmware. This includes Differentiated System Description Table (DSDT), Secondary System Description Table (SSDT), and Static Resource Affinity Table (SRAT), for example.
https://en.wikipedia.org/wiki/Advanced_Configuration_and_Pow...
Re: Bypass kernel lockdown/UEFI secure boot on Ubuntu 18.04 with ACPI SSDT injection
#6Requires the ability to edit information in /boot and to reboot, so effectively root access but it does circumvent secure boot.
The idea of secure boot is to have a security level above root. So that even if you gain root level access, you can't put an APT onto the box or similar.
Agreed, so it's definitely a bug. But it does require disabling kernel address translation and two reboots.
Secure boot doesn't disable installing APTs, it disables installing kernel modules.
If you want to disable apts etc, you need SELinux or AppArmor or equivalent.
Re: Bypass kernel lockdown/UEFI secure boot on Ubuntu 18.04 with ACPI SSDT injection
#7Requires the ability to edit information in /boot and to reboot, so effectively root access but it does circumvent secure boot.
Maybe you don't need physical access, but through some RCE and then inject the module.
Re: Bypass kernel lockdown/UEFI secure boot on Ubuntu 18.04 with ACPI SSDT injection
#8Requires the ability to edit information in /boot and to reboot, so effectively root access but it does circumvent secure boot.
Maybe you don't need physical access, but through some RCE and then inject the module.
I said root access, not physical :) so I agree, you don't need physical access.
Re: Bypass kernel lockdown/UEFI secure boot on Ubuntu 18.04 with ACPI SSDT injection
#9Earlier quoted context omitted.
The idea of secure boot is to have a security level above root. So that even if you gain root level access, you can't put an APT onto the box or similar.
Agreed, so it's definitely a bug. But it does require disabling kernel address translation and two reboots. Secure boot doesn't disable installing APTs, it disables installing kernel modules. If you want to disable apts etc, you need SELinux or AppArmor or equivalent.
You may want to think that statement through a bit more.
Secure boot, as the name suggests, secures initial loading of the most central/core parts of an operating system: (indeed) the kernel and kernel modules.
While APTs can be installed on different levels, anywhere from kernel up to user space, a good (hard to detect) place for those is inside the kernel itself or in a kernel module.
Secure boot is definitely intended to prevent APTs, even if its only a part of the the full equation. You still need additional tools on top of a kernel, e.g. SELinux or AppArmor, that monitor, audit and (hopefully) prevent the introduction of APTs. However, without a trusted kernel (and kernel modules), all of those tools can be compromised/circumvented, making it ultimately an impossible task to secure the system as a whole.
Re: Bypass kernel lockdown/UEFI secure boot on Ubuntu 18.04 with ACPI SSDT injection
#10Very cool. A very clever exploit.