I Don't Want to Sleep Tonight:
Subverting Intel TXT with S3 Sleep
Seunghun Han, Jun-Hyeok Park
(hanseunghun || parkparkqw)@nsr.re.kr
Wook Shin, Junghwan Kang, HyoungChun Kim(wshin || ultract || khche)@nsr.re.kr

Who Are We?
- Senior security researcher at NSR (National Security ResearchInstitute of South Korea)- Speaker at Black Hat Asia 2017 and HITBSecConf 2016/2017- Author of the book series titled “64-bit multi-core OS principles
and structure, Vol.1&2”- a.k.a kkamagui, @kkamagui1- Senior security researcher at NSR- Embedded system engineer- Interested in firmware security and IoT security- a.k.a davepark, @davepark312

Goal of This Presentation- We present new attack vector, “S3 Sleep” to subvert
hardware-based security- S3 sleeping state cuts off the power of CPU and devices- We intercept control flow while system wakes up and subvert
hardware-based security- We present new vulnerability, “Lost Pointer” (CVE-201716837)- “Lost pointer” is a software vulnerability in tBoot which is areference implementation of Intel TXT- We explain the vulnerability in detail and show mitigation

Background
Boot Protection Mechanisms
Intel Trust Execution Technology (TXT)
and tBoot

Lost Pointer Vulnerability and Demo.
Mitigation and Conclusion(with Black Hat Sound Bytes)

Saving Power is Important!
- Power Consumption == Cost
- Many companies worry about power consumption, because …
- Low Power Consumption = Low Electricity Fee!

- Power Consumption == Running Time
- Your laptop works on BATTERY!
- Low Power Consumption = Long Running Time = Inner Peace!
- We wish the battery could last a day, but, …

Saving Power is Important!
- Power Consumption == Cost
- Many companies worry about power consumption, because …
- Low Power Consumption = Low Electricity Fee =Low Manufacturing Cost!

!

- Power Consumption == Running Time!!

- Your laptop works on BATTERY!
- Low Power Consumption = Long Running Time = Inner Peace!
- We wish the battery could last a day, but, …

Advanced Configuration and PowerInterface (ACPI) Sleeping States
Wake Up
S1
Sleep

Sleeping

Boot

S2
G2 (S5)

G0 (S0)Soft OffWorking

Sleep

Sleeping

S3
Power
ButtonSMI

Sleep

Sleeping

S4
OEM S4BIOS Handler

Sleeping

Sleep

G1 (S1-S4)

Impacts of ACPI Sleeping States- Impacts of ACPI sleeping states are as follows:- S0: Normal, no context is lost
- S1: Standby, the CPU cache is lost
- S2: Standby, the CPU is POWERED OFF- S3: Suspend, CPU and devices are POWERED OFF- S4: Hibernate, the CPU, devices, and RAM are POWEREDOFF- S5: Soft Off, all parts are POWERED OFF

Impacts of ACPI Sleeping States- Impacts of ACPI sleeping states are as follows:- S0: Normal, no context is lost
- S1: Standby, the CPU cache is lost
- S2: Standby, the CPU is POWERED OFF- S3: Suspend, CPU and devices are POWERED OFF- S4: Hibernate, the CPU, devices, and RAM are POWEREDOFF- S5: Soft Off, all parts are POWERED OFF

POWER OFF ?!

ACPI Sleeping State and Security- Sleeping states cut off the power of CPU, devices, andRAM!
- If the OS works with sleeping states, security hardware
must do so- Because of power off, their states need to be restored
and reinitialized for waking up

If we intercept sleep and wake up,
we can do something interesting!

Attack Surface of S3 Sleeping Statein Linux Kernel
Notify Power Manager Chain(Sleep)- pm_notifier_call_chain()- 64bit Mode, Multiple CPU

Notify Device Chain(Sleep)- dpm_prepare(), dpm_suspend(), dpm_suspend_late()- 64bit Mode, Single CPU

Sleep, De-Power of CPU and Devices- acpi_os_enter_sleep()

Wake Up (Vector of ACPI) and Resume Kernel- Real Mode, Single CPU

Notify Device Chain(Resume)- dpm_resume_noirq(), dpm_resume()- 64bit Mode, Single CPU

Notify Power Manager Chain(Resume)- pm_notifier_call_chain()- 64bit Mode, Multiple CPUAttack Surface of S3 Sleeping Statein Linux Kernel
Notify Power Manager Chain(Sleep)- pm_notifier_call_chain()- 64bit Mode, Multiple CPU

Notify Device Chain(Sleep)- dpm_prepare(), dpm_suspend(), dpm_suspend_late()- 64bit Mode, Single CPU

Sleep, De-Power of CPU and Devices- acpi_os_enter_sleep()

Wake Up (Vector of ACPI) and Resume Kernel- Real Mode, Singlecontrol
CPU
You can intercept
flow by
Notify Device Chain(Resume)- dpm_resume_noirq(),
dpm_resume()
registeringacallbackfunction!
- 64bit Mode, Single CPU

Notify Power Manager Chain(Resume)- pm_notifier_call_chain()- 64bit Mode, Multiple CPUNow,
we got the power to change
control flow!

Let’s get intoa more privileged level!

Background
Boot Protection Mechanisms
Intel Trust Execution Technology (TXT)
and tBoot

Lost Pointer Vulnerability and Demo.
Mitigation and Conclusion(with Black Hat Sound Bytes)

Boot Protection Mechanisms- Secure boot of
Unified Extensible Firmware Interface (UEFI)- CHECKS a cryptographic signature of the binary executed in thenext step PRIOR TO the execution- Stops the execution if the executable file has no valid signature- Measured boot
- MEASURES a hash of the binary executed in the next step PRIOR
TO the execution, and then stores the measurement to the securestorage of Trusted Platform Module (TPM)- CHECKS the platform hashes in TPM AFTER the boot processTrusted Platform Module (TPM)- TPM is designed to provide hardware-based
security functions and build up a trusted platform- It is a tamper-resistant device and has a random number generator,
encryption functions, Platform Configuration Registers (PCRs), etc.
- It has been widely deployed in commercial products- Trusted Computing Group makes MANY specifications about TPM- PCRs of TPM store hashes and reveal the system status- They can be used to seal data (like BitLocker) and verified by remoteattesterTrusted Platform Module (TPM)- TPM is designed to provide hardware-based
security functions and build up a trusted platform- It is a tamper-resistant device and has a random number generator,
encryption functions, Platform Configuration Registers (PCRs), etc.
PCRs
arestoredsafelyand…
- It has been widely deployed in commercial devices- Trusted Computing
makes MANY
specifications about TPM
TheyGroup
cannotbe reset- PCRs ofwhile
TPM store
hashesandrevealthesystemstatusthe system is running!

- They can be used to seal data (like BitLocker) and verified by remoteattesterStatic and Dynamic
Root of Trust for Measurement- Root of Trust for Measurement (RTM) of TCG architecture is
the trust anchor of a measurement chain- Static RTM makes a chain from Core RTM (CRTM)- CRTM in protected firmware block starts at power-on state or restart- Dynamic RTM makes a chain at runtime without power-onor restart- It executes a special code module (DRTM Configuration Environment,
DCE) and it ensures the platform is in a trustworthy state- DCE executes a Dynamically Launched Measured Environment (DLME)Background
Boot Protection Mechanisms
Intel Trust Execution Technology (TXT)
and tBoot

Lost Pointer Vulnerability and Demo.
Mitigation and Conclusion(with Black Hat Sound Bytes)

Intel Trusted Execution Environment- Intel Trusted Execution Technology (TXT) is the DRTM tech.
- Intel just uses different terminologies- ex) DCE = Secure Initialization Authenticated Code Module (SINIT ACM)DLME = Measured Launched Environment (MLE)- It extends hashes of SINIT ACM and MLE to TPM- Intel TXT has a special command (SENTER and SEXIT) to
enter trustworthy state and exit from it- SENTER checks if SINIT ACM has a valid signature- Intel publishes SINIT ACM on the website

Trusted Boot (tBoot)- tBoot is a reference implementation of Intel TXT- It is an open source project (https://sourceforge.net/projects/tboot/)- It has been included many Linux distros such as RedHat, SUSE, andUbuntu- tBoot can verify OS and VMM- It measures TXT and OS components and stores hashes to TPM- Measured results in PCRs of TPM can be verified by remoteattestation server such as Intel Open CIT- It is typically used in server environments

Boot Process with tBootCPU: Execution: Measurement

Microcode

SENTER
tBoot
CRTM

BIOS/UEFI
Code

GRUB

PreLaunchCode
PCR #17SINIT
ACM

PostLaunch
Code

KernelinitrdPCR #18,
PCR #19

TPM
Static PCRs (PCR#0-15)

Dynamic PCRs (PCR#17-22)

tBoot
Tools

IMAGINE SECURE WORLD

WITH TRUSTED BOOT!

Background
Boot Protection Mechanisms
Intel Trust Execution Technology (TXT)
and tBoot

Lost Pointer Vulnerability and Demo.
Mitigation and Conclusion(with Black Hat Sound Bytes)

Previous Works on tBoot (1)- “Attacking Intel trusted execution technology”, Black Hat
DC (2009)- System Management Mode (SMM) code attack- “Another way to circumvent Intel trusted execution
technology”, Invisible Things Lab (2009)- DMA remapping table (DMAR table) attack- “Attacking Intel TXT via SINIT code execution hijacking”,
Invisible Things Lab (2011)- Also DMAR table attack

Previous Works on tBoot (2)- “Breaking hardware-enforced security with hypervisor”,
Black Hat USA (2016)- SENTER emulation with malicious hypervisor

Many researchers have aimed atIntel TXT and tBoot!

But, they only focused on the boot process!

Sleep and Waking Up Sequence oftBoot
Seal S3 key and MAC of Kernel Memory with Post-Launch PCRs
- seal_post_k_state()  g_tpm->seal()

Save Static PCRs(0~16)- tpm->save_state()

Shutdown Intel TXT- txt_shutdown()

Sleep. De-Power of CPU and the TPM!
- shutdown_system()

Wake Up, Restore Static PCRs, and Resume tBoot- Real Mode, Single CPU

Launch MLE again and then, Unseal S3 key and MAC with P-Launch
PCRs- begin_launch()  txt_s3_launch_environment()- post_launch()  s3_launch()  verify_integrity()  g_tpm->unseal()

Extend PCRs and Resume Kernel- verify_integrity()  extends_pcrs() - s3_launch()->_prot_to_real()

g_tpmextend()

Sleep and Waking Up Sequence oftBoot
Seal S3 key and MAC of Kernel Memory with Post-Launch PCRs
- seal_post_k_state()  g_tpm->seal()

Save Static PCRs(0~16)- tpm->save_state()

Shutdown Intel TXT- txt_shutdown()

Sleep. De-Power of CPU and the TPM!
- shutdown_system()?!

Wake Up, Restore Static PCRs, and Resume tBoot- Real Mode, Single CPU

Launch MLE again and then, Unseal S3 key and MAC with P-Launch
PCRs- begin_launch()  txt_s3_launch_environment()- post_launch()  s3_launch()  verify_integrity()  g_tpm->unseal()

Extend PCRs and Resume Kernel- verify_integrity()  extends_pcrs() - s3_launch()->_prot_to_real()

g_tpmextend()

“Lost Pointer” Vulnerability(CVE-2017-16837)
Multiboot Header_mle_start
Code (.text)_mle_end

Read-Only Data(.rodata)

Initialized Data(.data)struct tpm_if *g_tpm
struct tpm_if tpm_12_if
struct tpm_if tpm_20_if
Uninitialized Data(.bss)…

Memory Layout of tBoot

Measured by Intel TXT!

“Lost Pointer” Vulnerability(CVE-2017-16837)
Multiboot Header_mle_start
Code (.text)_mle_end

Read-Only Data(.rodata)

Measured by Intel TXT!

… ?! …

Initialized Data(.data)struct tpm_if *g_tpm
struct tpm_if tpm_12_if
struct tpm_if tpm_20_if
Uninitialized Data(.bss)…

Memory Layout of tBoot

UNMEASURED!

Hijack the Control Flow andExploit tBoot!
Multiboot Header

Hook tpm_12_if structure for g_tpm(extend_pcr  hook_extend_pcr)_mle_start
Code (.text)_mle_end

Hook tpm_20_if structure for g_tpm(extend_pcr  hook_extend_pcr)

Read-Only Data(.rodata)

Initialized Data(.data)struct tpm_if *g_tpm
struct tpm_if tpm_12_ifbool hook_extend_pcr(pcr, hash)for tpm_12_if and tpm_20_if{
hash18 = a good hash for PCR 18
hash19 = a good hash for PCR 19

struct tpm_if tpm_20_if
if (pcr == 18)
return org_extend_pcr(pcr,
hash18);else if (pcr == 19)
return org_extend_pcr(pcr,
hash19);else
return org_extend_pcr(pcr,hash);

Shell Code for
Forging Measurements
Uninitialized Data(.bss)…

Memory Layout of tBoot}Put it all together!
Bad PCRs(18, 19)

Power OnGood PCRs(18, 19)
ExtendRecorded
PCRs in tBoot

Load
Grub

Load
tBoot

Load
Modified
KernelInsertKernelModulePatch
tpm_if oftBoot

Force to
Sleep

Register
Sleep
Notification

TPM isRESET!
SystemSleep andWake UpIn Notifier
Chain
ResumeKernelSubvertthe System: Good PCRs

: Bad PCRs

IMAGINE SECUREWORLD
Put it all
together!
Bad PCRs

Power OnGood PCRs(18, 19)
ExtendRecorded
PCRs in tBoot

Load
Grub

(18, 19)with Your Belief!

Load
tBoot

Load
Modified
KernelInsertKernelModulePatch
tpm_if oftBoot

Force to
Sleep

Register
Sleep
Notification

TPM isRESET!
SystemSleep andWake UpIn Notifier
Chain… AND KEEP IT UP, DUDE!
: Good PCRs
ResumeKernelSubvertthe System: Bad PCRs

DEMO

Background
Boot Protection Mechanisms
Intel Trust Execution Technology (TXT)
and tBoot

Lost Pointer Vulnerability and Demo.
Mitigation and Conclusion(with Black Hat Sound Bytes)

Mitigation –Measure Function Pointers (1)Multiboot Header_mle_startCode(.text)_mle_end

Read-Only Data(.rodata)

Initialized Data(.data)struct tpm_if *g_tpm
struct tpm_if tpm_12_if_mle_end

struct tpm_if tpm_20_if…
Uninitialized Data(.bss)…

Memory Layout of tBoot

Measured byIntel TXT!

Mitigation –Measure Function Pointers (2)Extract Data fromTPM Interfaces

Move Interfaces toRead-Only Area

Conclusion andBlack Hat Sound Bytes- ACPI S3 sleeping states turn off the CPU and the TPM- When the system wakes up, it should turn on security function of
CPU and recover PCRs of TPM- tBoot does not measure all function pointers!
- “Lost Pointer” vulnerability can be used to forge the PCR values
while system sleeps and wakes up- tBoot should measure all data related to the control flow

- Update your tBoot to the latest version!
- Or disable the sleep feature in your BIOS!

Questions ?

EMAIL!
Contact: hanseunghun@nsr.re.kr, @kkamagui1
parkparkqw@nsr.re.kr, @davepark312

Reference- Trusted Computing Group. “TCG D-RTM Architecture.” 2013.
- Trusted Computing Group. “TCG PC Client Specific Implementation Specification forConventional BIOS.” 2012.
- Intel. “Intel Trusted Execution Technology (Intel TXT).” 2017.
- Wojtczuk, Rafal, and Joanna Rutkowska. “Attacking intel trusted execution technology.”
Black Hat DC. 2009.
- Wojtczuk, Rafal, Joanna Rutkowska, and Alexander Tereshkin. “Another way to circumvent
Intel trusted execution technology.” Invisible Things Lab. 2009.
- Wojtczuk, Rafal, and Joanna Rutkowska. “Attacking Intel TXT via SINIT code execution
hijacking.” Invisible Things Lab. 2011.
- Sharkey, Joseph. “Breaking hardware-enforced security with hypervisors.” Black Hat USA.
2016.