Researchers Demonstrate Firmware Persistence on AMD-Based Laptops

Summary

Researchers demonstrated how firmware vulnerabilities and security misconfigurations on AMD-based laptops could enable persistent system management mode access after an operating system compromise.

Key points

• The research assumed an attacker had already obtained operating system kernel privileges and sought persistent access to system management mode (SMM).
• Researchers found an unlocked SMM protection register on one system and reported that tested AMD systems generally lacked protections against SMM code execution outside protected memory.
• Unconfigured SPI flash restrictions and an SMM handler with insufficient parameter validation provided paths to manipulate firmware or SMM memory on affected systems.
• The team demonstrated a firmware backdoor that configured an SMM key at boot, allowing a second exploit to disable memory protections and access SMM code.
• On a ThinkPad p6s, researchers found that the firmware verification list omitted some firmware volumes and could itself be manipulated, despite platform secure boot being enabled.
• The researchers reported more than 20 vulnerabilities across AMD reference code and firmware suppliers. They cautioned that their reverse-engineering conclusions could contain inaccuracies.

Vendors