Intel Skylake/Kaby Lake: broken hyper-threading

Henrique de Moraes Holschuh  of the Debian project posted a message about an Intel hyper-threading issue:

[WARNING] Intel Skylake/Kaby Lake processors: broken hyper-threading

This warning advisory is relevant for users of systems with the Intel processors code-named “Skylake” and “Kaby Lake”. These are: the 6th and 7th generation Intel Core processors (desktop, embedded, mobile and HEDT), their related server processors (such as Xeon v5 and Xeon v6), as well as select Intel Pentium processor models.

TL;DR: unfixed Skylake and Kaby Lake processors could, in some situations, dangerously misbehave when hyper-threading is enabled. Disable hyper-threading immediately in BIOS/UEFI to work around the problem. Read this advisory for instructions about an Intel-provided fix.

[…]

Full message:

https://lists.debian.org/debian-devel/2017/06/msg00308.html

EFI variable support for U-Boot

Rob Clark has an RFC patch to U-Boot, with UEFI variable support:

[RFC] efi: variable support

Mapping from EFI variables to grub variables. Still almost as many TODOs as lines of code, but just figured I’d send out an early version for comments. I was thinking of it as a useful way for u-boot to pass values to grub (although grub is still missing a way for grub scripts to retrieve UEFI variables). The rough idea is to encode GUID + variable name plus “efi_” prefix (to avoid unintended u-boot variables leaking into the UEFI world). And then encode the type (and attributes?) in the string value of the variable. Ie. something like:

setenv efi_8be4df6193ca11d2aa0d00e098032b8c_OsIndicationsSupported (u64)0

Full patch/thread:
https://lists.denx.de/listinfo/u-boot

 

Adaptiva Secure 10: BIOS to UEFI

New registration-required freeware from Adaptiva:

Adaptiva’s free Secure 10 is a complete automation solution for ConfigMgr admins to make the BIOS to UEFI conversion process simple and unattended. With Secure 10, migrations take much less time and no IT staff need to be on-site during the process. Now including support for new MBR2GPT.exe tool for retaining data while making the switch, as well as ConfigMgr 1610+ WinPE boot image pre-staging. Also new: two complete task sequences to save time integrating into your deployments! […] The open solution includes detailed documentation to help SCCM system administrators overcome the complexities of automating the conversion from:

* BIOS to UEFI – Secure 10 automates the conversion process from the legacy BIOS firmware typically used in Windows 7/8 systems to the more powerful Unified Extensible Firmware Interface (UEFI) technology. UEFI is required to enable key enterprise security features available in Windows 10.

* MBR to GPT – Secure 10 now includes support for the MBR2GPT.exe tool, which helps convert the disk layout on a PC from the legacy Master Boot Record (MBR) to GUID Partition Table (GPT). The new tool is the only Microsoft-supported tool to convert a production disk from MBR to GPT without data loss, greatly speeding in-place upgrades to Windows 10.

* WinPE Pre-staging – Microsoft recently introduced the capability to pre-stage a WinPE boot image to a partition from within an SCCM Task Sequence and have that image persist during the conversion from MBR to GPT. Secure 10 supports this capability for refresh/replace scenarios.

https://www.adaptiva.com/blog/2017/adaptiva-releases-bios-uefi-solution-update-speed-windows-10-migrations/

OpenBSD gets KARL (Kernel Address Randomized Link)

http://undeadly.org/cgi?action=article&sid=20170613041706

https://marc.info/?l=openbsd-tech&m=149732265506347&w=2

 

Over the last three weeks I’ve been working on a new randomization feature which will protect the kernel. The situation today is that many people install a kernel binary from OpenBSD, and then run that same kernel binary for 6 months or more. We have substantial randomization for the memory allocations made by the kernel, and for userland also of course. However that kernel is always in the same physical memory, at the same virtual address space (we call it KVA). Improving this situation takes a few steps.[…]

http://www.jupiterbroadcasting.com/115961/read-the-source-karl-bsd-now-199/

Apple ACPI _DSD and _DSM

Lukas Wunner submitted a patch to the Linux-(kernel,ACPI) lists with an ACPI patch to support Apple _DSM properties. Comments included below:

While the rest of the world has standardized on _DSD as the way to store device properties in AML (introduced with ACPI 5.1 in 2014), Apple has been using a custom _DSM to achieve the same for much longer (ever since they switched from DeviceTree-based PowerPC to Intel in 2005, verified with MacOS X 10.4.11).

The theory of operation on macOS is as follows: AppleACPIPlatform.kext invokes mergeEFIproperties() and mergeDSMproperties() for each device to merge properties conveyed by EFI drivers as well as properties stored in AML into the I/O Kit registry from which they can be retrieved by drivers. We’ve been supporting EFI properties since commit 58c5475aba67 (“x86/efi: Retrieve and assign Apple device properties”). The present commit adds support for _DSM properties, thereby completing our support for Apple device properties. The _DSM properties are made available under the primary fwnode, the EFI properties under the secondary fwnode. So for devices which possess both property types, they can all be elegantly accessed with the uniform API in <linux/property.h>.

Until recently we had no need to support _DSM properties, they contained only uninteresting garbage. The situation has changed with MacBooks and MacBook Pros introduced since 2015: Their keyboard is attached with SPI instead of USB and the _CRS data which is necessary to initialize the spi driver only contains valid information if OSPM responds “false” to _OSI(“Darwin”). If OSPM responds “true”, _CRS is empty and the spi driver fails to initialize. The rationale is very simple, Apple only cares about macOS and Windows: On Windows, _CRS contains valid data, whereas on macOS it is empty. Instead, macOS gleans the necessary data from the _DSM properties.

Since Linux deliberately defaults to responding “true” to _OSI(“Darwin”), we need to emulate macOS’ behaviour by initializing the spi driver with data returned by the _DSM.

An out-of-tree driver for the SPI keyboard exists which currently binds to the ACPI device, invokes the _DSM, parses the returned package and instantiates an SPI device with the data gleaned from the _DSM:
https://github.com/cb22/macbook12-spi-driver/commit/9a416d699ef4
https://github.com/cb22/macbook12-spi-driver/commit/0c34936ed9a1

By adding support for Apple’s _DSM properties in generic ACPI code, the out-of-tree driver will be able to register as a regular SPI device, significantly reducing its amount of code and improving its chances to be mainlined.

The SPI keyboard will not be the only user of this commit: E.g. on the MacBook8,1, the UART-attached Bluetooth device likewise returns empty _CRS data if OSPM returns “true” to _OSI(“Darwin”).

The _DSM returns a Package whose format unfortunately deviates slightly from the _DSD spec: The properties are marshalled up in a single Package as alternating key/value elements, unlike _DSD which stores them as a Package of 2-element Packages. The present commit therefore converts the Package to _DSD format and the ACPI core can then treat the data as if Apple would follow the standard.

Well, except for one small annoyance: The properties returned by the _DSM only ever have one of two types, Integer or Buffer. The former is retrievable as usual with device_property_read_u64(), but the latter is not part of the _DSD spec and it is not possible to retrieve Buffer properties with the device_property_read_*() functions due to the type checking performed in drivers/acpi/property.c. It is however possible to retrieve them with acpi_dev_get_property(). Apple is using the Buffer type somewhat sloppily to store null-terminated strings but also integers. The real data type is not distinguishable by the ACPI core and the onus is on the caller to use the contents of the Buffer in an appropriate way.

In case Apple moves to _DSD in the future, this commit first checks for _DSD and falls back to _DSM only if _DSD is not found.

 

DumpPartInfo

Hao Wu of Intel posted a patch to EDK2 which provides support for UEFI’s “EFI Partition Infomation Protocol”, and includes a DumpPartInfo tool:

Add the EFI Partition Information Protocol per the latest UEFI spec.

Test for the series:
A simple application called ‘DumpPartInfo’ is used to dump the contents of the Partition Information protocols when the following devices are attached:
a. MBR Hard disk
b. GPT Hard disk
c. CDROM

The source of the application and the series is available at:
https://github.com/hwu25/edk2 branch:partition_info_test

8 files changed, 216 insertions(+), 88 deletions(-)

Dmytro on PCI-E/SMM vulnerability

Dmytro has an interesting 6-part twitter post on PCI-e security:

FWTS 17.06.00 released

Alex Hung of Canonical.com announced the 17.06.00 release of FWTS (FirmWare Test Suite).

New Features:
* ACPICA: Update to version 20170531
* olog: olog.json: Update OPAL skiboot errors to check on olog scan
* bios: mtrr: print out actual default type of MTRR

See the full announcement for the list of bugs fixed in this release.

https://launchpad.net/ubuntu/+source/fwts
http://fwts.ubuntu.com/release/fwts-V17.06.00.tar.gz
https://launchpad.net/~firmware-testing-team/+archive/ubuntu/ppa-fwts-stable
https://wiki.ubuntu.com/FirmwareTestSuite/ReleaseNotes/17.06.00

Umap2: USB host security assessment tool

Umap2 is the second revision of NCC Group’s python based USB host security assessment tool. This revision will have all the features that were supported in the first revision:

* umap2emulate – USB device emulation
* umap2scan – USB host scanning for device support
* umap2detect – USB host OS detection (no implemented yet)
* umap2fuzz – USB host fuzzing

In this revision there will be some additional features:

* USB host fuzzing uses kitty as fuzzing engine
* Umap2 not only contains executable scripts, but is also installed as a package and may be used as a library

Umap2 is developed by NCC Group and Cisco SAS team.[…]

 

https://github.com/nccgroup/umap2
http://goodfet.sourceforge.net/hardware/facedancer21/

See-also:

https://blog.flameeyes.eu/2017/06/free-idea-a-qemu-facedancer-fuzzer/

 

Debian 9 “Stretch” released

Excerpts of announcement included below. For full announcement, see the debian-announce mailing list archives.

 After 26 months of development the Debian project is proud to present its new stable version 9 (code name “Stretch”), which will be supported for the next 5 years thanks to the combined work of the Debian Security team and of the Debian Long Term Support team. Debian 9 is dedicated to the project’s founder Ian Murdock, who passed away on 28 December 2015.

The UEFI (“Unified Extensible Firmware Interface”) support first introduced in “Wheezy” continues to be greatly improved in “Stretch”, and also supports installing on 32-bit UEFI firmware with a 64-bit kernel. The Debian live images now include support for UEFI booting as a new feature, too.

A total of ten architectures are supported: 64-bit PC / Intel EM64T / x86-64 (amd64), 32-bit PC / Intel IA-32 (i386), 64-bit little-endian Motorola/IBM PowerPC (ppc64el), 64-bit IBM S/390 (s390x), for ARM, armel and armhf for older and more recent 32-bit hardware, plus arm64 for the 64-bit “AArch64” architecture, and for MIPS, in addition to the two 32-bit mips (big-endian) and mipsel (little-endian), there is a new mips64el architecture for 64-bit little-endian hardware. Support for 32- bit Motorola/IBM PowerPC (powerpc) has been removed in “Stretch”.

https://www.debian.org/News/2017/20170617
http://ftp.debian.org/debian/doc/dedication/dedication-9.0.txt
https://www.debian.org/releases/stretch/installmanual
https://www.debian.org/releases/stretch/releasenotes

 

CHIPSEC in BlackArch Linux

It has been in there for a while, but I don’t think I’ve seen an announcement.

https://github.com/BlackArch/blackarch/issues/1568
https://github.com/BlackArch/blackarch/tree/master/packages/chipsec
https://www.blackarch.org/tools.html
https://www.blackarch.org/hardware.html
https://www.blackarch.org/downloads.html

So you can use LUV-live to use CHIPSEC in a batch mode, or you can use BlackArch live to use CHIPSEC in an interactive mode.

PS: Kali status:
https://bugs.kali.org/view.php?id=3940
https://github.com/chipsec/chipsec/wiki/Using-CHIPSEC-with-Kali-Linux

Daniel Gruss: Software-based Microarchitectural Attacks

Daniel Gruss
Software-based Microarchitectural Attacks
PhD Thesis
[…]This thesis consists of two parts. In the first part, we provide background on modern processor architectures and discuss state-of-the-art attacks and defenses in the area of microarchitectural side-channel attacks and microarchitectural fault attacks.[…]

Click to access phd_defense_slides.pdf

Click to access phd_thesis.pdf

HPE increases ProLiant firmware security

HPE’s Gen10 Servers Will Have Security Drilled into Silicon

by Christine Hall on June 12, 2017

Hewlett Packard Enterprise unveiled Gen10 at Discover in Las Vegas last week, the first major upgrade to its ProLiant line of servers since Gen9 was released in 2014. While the release of a new server is generally not very interesting in this age of commodity hardware, this one is a bit more notable as it has some interesting security features built into the hardware. The announcement was made by Alain Andreoli, head of HPE’s infrastructure group, with no shortage of hyperbole: “We have definitively created the world’s most secure industry standard server.” The security feature works at the firmware level, utilizing custom HPE silicon. “In each Gen10 server we have created a unique individual fingerprint for the silicon,” Andreoli explained. “Your server will not boot unless the firmware matches this print — it is just locked end to end.”[…]

http://www.datacenterknowledge.com/archives/2017/06/12/hpes-gen10-servers-will-have-security-drilled-into-silicon/

 

Project IceStorm and iCEstick

Project IceStorm aims at reverse engineering and documenting the bitstream format of Lattice iCE40 FPGAs and providing simple tools for analyzing and creating bitstream files. The IceStorm flow (Yosys, Arachne-pnr, and IceStorm) is a fully open source Verilog-to-Bitstream flow for iCE40 FPGAs. The focus of the project is on the iCE40 LP/HX 1K/4K/8K chips. (Most of the work was done on HX1K-TQ144 and HX8K-CT256 parts.)

Project IceStorm

The iCEstick Evaluation Kit is an easy to use, small size board that allows rapid prototyping of system functions at a very low cost using Lattice Semiconductor’s iCE40 FPGA family.

http://www.latticesemi.com/icestick