PSPReverse/amd-sp-glitch

Is this attack still successful?

christianschmucker opened this issue · 3 comments

christianschmucker commented

Hello,
I‘m currently writing a small paper about AMD SEV(-SNP) for a seminar about secure os technologies at my university. You presented this attack one year ago. Could you tell me if this issue has already been fixed? And if so, how? Thanks in advance!

viniul commented

Hi Christian,

Thanks for your questions! To the best of our knowledge, the glitch attack is still possible.

The most recent iteration of AMD SEV, AMD-SNP, was introduced to add countermeasures against software based host-to-guest attacks. A very important feature of AMD-SNP is adding integrity protection for the guest's memory. This integrity protection mitigates various attacks that abused that the host can modifies the guest's memories content (albeit only being able to change the ciphertext), c.f. [1].

These mitigations are unrelated to the hardware based glitch attack, which happens during boot time and target the AMD-SP.

Good luck & have fun with your paper.

[1] SEVurity: No Security Without Integrity -- Breaking Integrity-Free Memory Encryption with Minimal Assumptions https://arxiv.org/abs/2004.11071

  • 👍1
christianschmucker commented

Ok, thank you very much! :)

aryxes commented

Can I use it to my Ryzen over usb/uart only without spi emulation?