BadRAM Breaks AMD’s SEV-SNP Trusted Execution Protection
This Will Be An Exploit To Remember
Today’s bad news comes from researchers at KU Leuven, the University of Lübeck, and the University of Birmingham and it concerns anyone running an EPYC processor. They have discovered a very cheap way to break the protection offered by AMD’s SEV-SNP and have dubbed it BadRAM. They’ve found a way to use either a $10 piece of hardware, or in some cases, software only, to cause DDR4 or DDR5 memory modules to misreport during bootup the amount of memory capacity they have. Once that memory has been segregated it is used to suppress the cryptographic hash SEV-SNP uses to report if a virtual machine has been compromised.
While the fact you need physical access to the EPYC based system is relatively good news, this attack is aimed at cloud service providers. If someone manages to get access to their banks of servers there is no telling how many systems could be compromised nor which sites would be affected. Intel’s Scalable SGX and TDX processors are not vulnerable to BadRAM and at this time ARM based servers have not been tested.
If you want more technical details about BadRAM than the article at Ars Technica covers you can go straight to the source.
On Tuesday, an international team of researchers unveiled BadRAM, a proof-of-concept attack that completely undermines security assurances that chipmaker AMD makes to users of one of its most expensive and well-fortified microprocessor product lines.
More Tech News From Around The Web
- New Cleo zero-day RCE flaw exploited in data theft attacks @ Bleeping Computer
- Vertical-nanowire transistors defeat the Boltzmann tyranny @ Physics World
- China’s Salt Typhoon recorded top American officials’ calls, says White House @ The Register
- Scientific Breakthrough Gives New Hope To Building Quantum Computers @ Slashdot
- Apple hit with $1.2B lawsuit after killing controversial CSAM-detecting tool @ Ars Technica
- Musicians Rally Behind Internet Archive in $621 Million Music Label Battle @ Slashdot
