Bypassing IOMMU Protection against I/O Attacks - Archive ouverte HAL
Communication Dans Un Congrès Année : 2016

Bypassing IOMMU Protection against I/O Attacks

Résumé

Attacks targeting computer systems become more and more complex and various. Some of them, so-called I/O attacks, are performed by malicious peripherals that make read or write accesses to DRAM memory or to memory embedded in other peripherals, through DMA (Direct Memory Access) requests. Some protection mechanisms to face these attacks exist and have been implemented for several years now in modern architectures. A typical example is the IOMMU proposed by Intel. However, such mechanisms are not necessarily properly configured and used by the firmware and the operating system. This experimental paper describes a design weakness that we discovered in the configuration of an IOMMU by the Intel IOMMU Linux driver and a possible exploitation scenario that would allow a malicious peripheral to bypass the underlying protection mechanism. The exploitation scenario is implemented with a PCI Express peripheral FPGA, based on Intel specifications and Linux source code analysis.
Fichier principal
Vignette du fichier
Moragn-ladc-2016.pdf (190.15 Ko) Télécharger le fichier
Origine Fichiers produits par l'(les) auteur(s)
Loading...

Dates et versions

hal-01419962 , version 1 (20-12-2016)

Identifiants

Citer

Benoît Morgan, Eric Alata, Vincent Nicomette, Mohamed Kaâniche. Bypassing IOMMU Protection against I/O Attacks. 7th Latin-American Symposium on Dependable Computing (LADC’16), Oct 2016, Cali, Colombia. pp.145-150, ⟨10.1109/LADC.2016.31⟩. ⟨hal-01419962⟩
446 Consultations
4147 Téléchargements

Altmetric

Partager

More