search

PSPReverse / amd-sp-glitch

Supplemental material to our paper: "One Glitch to Rule Them All: Fault Injection Attacks Against AMD's Secure Encrypted Virtualization"
GNU General Public License v3.0
81 stars 11 forks source link

Is this attack still successful? #2

Open christianschmucker opened 1 year ago

christianschmucker commented 1 year ago

Hello, I‘m currently writing a small paper about AMD SEV(-SNP) for a seminar about secure os technologies at my university. You presented this attack one year ago. Could you tell me if this issue has already been fixed? And if so, how? Thanks in advance!

viniul commented 1 year ago

Hi Christian,

Thanks for your questions! To the best of our knowledge, the glitch attack is still possible.

The most recent iteration of AMD SEV, AMD-SNP, was introduced to add countermeasures against software based host-to-guest attacks. A very important feature of AMD-SNP is adding integrity protection for the guest's memory. This integrity protection mitigates various attacks that abused that the host can modifies the guest's memories content (albeit only being able to change the ciphertext), c.f. [1].

These mitigations are unrelated to the hardware based glitch attack, which happens during boot time and target the AMD-SP.

Good luck & have fun with your paper.

[1] SEVurity: No Security Without Integrity -- Breaking Integrity-Free Memory Encryption with Minimal Assumptions https://arxiv.org/abs/2004.11071

christianschmucker commented 1 year ago

Ok, thank you very much! :)

aryxes commented 1 year ago

Can I use it to my Ryzen over usb/uart only without spi emulation?