AMD VM security tools can be bypassed, letting hackers infilitrate your devices, experts warn

Computer Hacked, System Error, Virus, Cyber attack, Malware Concept. Danger Symbol
(Image credit: Shutterstock)

  • University researchers find way to trick AMD's secure VM tech into sharing sensitive information
  • AMD released a security advisory with recommended mitigations
  • The bug requires physical access, but in some scenarios could be abused through software alone

AMD Virtual Machine (VM) security tools can be bypassed, allowing cybercriminals to infiltrate devices and steal sensitive data, experts have warned.

Security researchers from multiple universities in the EU and the UK outlined how AMD chips come with Secure Encrypted Virtualization (SEV), a security feature designed to encrypt virtual machine (VM) memory to protect it from unauthorized access, including by the hypervisor or other VMs. SEV uses hardware-based encryption keys unique to each VM, ensuring data remains confidential and tamper-proof even in shared environments.

Recently, AMD upgraded SEV with Secure Nested Paging (SNP), an enhancement that should guarantee the integrity of a virtual machine's memory by validating memory page tables and preventing unauthorized modifications by the hypervisor. However, the researchers claim SNP can be bypassed, if the attacker has physical access to the target device. They used a Raspberry Pi Pico to “fake” additional RAM, and exfiltrated secrets from it. They call the attack BadRAM.

Attacks with and without hardware

By abusing the Serial Presence Detect (SPD) chip on the memory’s module, they created aliases for physical memory, which they could later access.

"In our attacks, we double the apparent size of the Dual Inline Memory Module (DIMM) installed in the system to trick the CPU's memory controller into using additional 'ghost' addressing bits," the researchers said in a research paper titled “BadRAM: Practical Memory Aliasing Attacks on Trusted Execution Environments”.

"These addressing bits will be unused within the virtually enlarged DIMM, creating an interesting aliasing effect where two different physical addresses now refer to the same DRAM location."

The technique works on DDR4 and DDR5 memory, and there’s even a possibility to use it without hardware, if the SPD chip is left unlocked (which, according to The Register, is sometimes the case).

In response, AMD released a security advisory, and is now tracking the flaw as CVE-2024-21944. It has gotten a severity score of 5.4 (medium). It recommends utilizing memory modules that lock SPD, as well as following physical security best practices. “In addition, the AGESA and SEV FW versions listed below have been released to the Original Equipment Manufacturers (OEM) to mitigate this issue. Please refer to your OEM for the BIOS update specific to your product.”

Further details can be found here.

Via The Register

You might also like

TOPICS

Sead is a seasoned freelance journalist based in Sarajevo, Bosnia and Herzegovina. He writes about IT (cloud, IoT, 5G, VPN) and cybersecurity (ransomware, data breaches, laws and regulations). In his career, spanning more than a decade, he’s written for numerous media outlets, including Al Jazeera Balkans. He’s also held several modules on content writing for Represent Communications.

Read more
AMD logo
AMD patches high severity security flaw affecting Zen chips
AMD logo
Security flaw means AMD Zen CPUs can be "jailbroken"
AMD Ryzen 5 7600X processor
AMD confirms processor security flaws after Asus patch slips out early
An abstract image of a lock against a digital background, denoting cybersecurity.
Apple CPU security issue could let hackers steal user data from browsers
Skull and Bones
Experts warn DNA sequencers are vulnerable to bootkit attacks
A person at a laptop with a cybersecure lock symbol floating above it.
Parallels Desktop has some worrying security flaws for Mac users
Latest in Security
Data leak
Hacked Tata Technologies data leaked by ransomware gang
China
Chinese hackers targeting Juniper Networks routers, so patch now
Google Chrome dark mode
Google updates Chrome extension rules to ban affiliate link injection without user action or benefit
Abstract image of robots working in an office environment including creating blueprint of robot arm, making a phone call, and typing on a keyboard
This worrying botnet targets unsecure TP-Link routers - thousands of devices already hacked
Avast cybersecurity
UK cybersecurity sector could be worth £13bn, research shows
An option to add Ambient Music buttons to the iOS 18.4 Control Center.
Apple fixes dangerous zero-day used in attacks against iPhones and iPads
Latest in News
Samsung Galaxy Z Fold 6
The Samsung Galaxy Z Fold 7 could be in line for a Galaxy S25 Ultra-level camera upgrade
Data leak
Hacked Tata Technologies data leaked by ransomware gang
A close up of Billy Bob Thornton's Tommy Norris in Paramount Plus' Landman TV series
The Taylor Sheridan supremacy lives on at Paramount+ as Landman gets renewed for season 2
Ryzen 9000 promotional material
AMD's most powerful processor ever actually runs better on Windows 10 than Windows 11
Intel CEO Lip-Bu Tan
Intel reveals its new CEO
The SAG-AFTRA San-Fransisco-North California Local
SAG-AFTRA union and video game industry bargaining group remain at odds as agreements on AI protections still 'frustratingly far apart'