Conference Papers Year : 2016

Bypassing IOMMU Protection against I/O Attacks

Abstract

Attacks targeting computer systems become more and more complex and various. Some of them, so-called I/O attacks, are performed by malicious peripherals that make read or write accesses to DRAM memory or to memory embedded in other peripherals, through DMA (Direct Memory Access) requests. Some protection mechanisms to face these attacks exist and have been implemented for several years now in modern architectures. A typical example is the IOMMU proposed by Intel. However, such mechanisms are not necessarily properly configured and used by the firmware and the operating system. This experimental paper describes a design weakness that we discovered in the configuration of an IOMMU by the Intel IOMMU Linux driver and a possible exploitation scenario that would allow a malicious peripheral to bypass the underlying protection mechanism. The exploitation scenario is implemented with a PCI Express peripheral FPGA, based on Intel specifications and Linux source code analysis.
Fichier principal
Vignette du fichier
Moragn-ladc-2016.pdf (190.15 Ko) Télécharger le fichier
Origin Files produced by the author(s)
Loading...

Dates and versions

hal-01419962 , version 1 (20-12-2016)

Identifiers

Cite

Benoît Morgan, Eric Alata, Vincent Nicomette, Mohamed Kaâniche. Bypassing IOMMU Protection against I/O Attacks. 7th Latin-American Symposium on Dependable Computing (LADC’16), Oct 2016, Cali, Colombia. pp.145-150, ⟨10.1109/LADC.2016.31⟩. ⟨hal-01419962⟩
457 View
4216 Download

Altmetric

Share

More