Glitching RISC-V chips: MTVEC corruption for hardening ISA

Presented at DEF CON 29 (2021), Aug. 8, 2021, 11 a.m. (45 minutes).

RISC-V is an open standard instruction set architecture (ISA) provided under open-source licenses that do not require fees to use. ISA is based on established reduced instruction set computer (RISC) principles. RISC-V has features to increase computer speed, while reducing cost and power use. Many industry players like Google, IBM, NVIDIA, Qualcomm, and Samsung are members of the RISC-V Foundation and have long supported RISC-V development. In 2016, NVIDIA unveiled plans to replace the internal microcontrollers of their graphic cards with next-gen RISC-V-based controllers built for upcoming NVIDIA GPUs. NVIDIA's Product Security undertook a detailed architectural analysis and research of the RISC-V IP, discovering a potential risk with the ambiguous specification of the Machine Trap Base Address (MTVEC) register. This ambiguity leads to potential fault injection vulnerabilities under physical attack models.

Presenters:

• Alex Matrosov
  Alex Matrosov is a well-recognized offensive security researcher. He has more than two decades of experience with reverse engineering, advanced malware analysis, firmware security, and exploitation techniques. Alex served as Chief Offensive Security Researcher at Nvidia, Intel Security Center of Excellence (SeCoE), spent more than six years in the Intel Advanced Threat Research team, and was Senior Security Researcher at ESET. Alex has authored and co-authored numerous research papers, and is a frequent speaker at security conferences, including REcon, Zeronigths, Black Hat, DEF CON, and others. Additionally, he is awarded by Hex-Rays for open-source plugin efiXplorer and HexRaysCodeXplorer which has been developed and supported since 2013 by REhint's team. @matrosov https://medium.com/firmware-threat-hunting
• Adam Zabrocki / pi3 - Principal System Software Engineer (Offensive Security) at NVIDIA   as Adam 'pi3' Zabrocki
  Adam 'pi3' Zabrocki is a computer security researcher, pentester and bughunter, currently working as a Principal Offensive Security Researcher at NVIDIA. He is a creator and a developer of Linux Kernel Runtime Guard (LKRG) - his moonlight project defended by Openwall. Among others, he used to work in Microsoft, European Organization for Nuclear Research (CERN), HISPASEC Sistemas (known from the virustotal.com project), Wroclaw Center for Networking and Supercomputing, Cigital. The main area of his research interest is a low-level security (CPU architecture, uCode, FW, hypervisor, kernel, OS). As a hobby, he was a developer in The ERESI Reverse Engineering Software Interface project, a bughunter (discovered vulnerabilities in Hyper-V hypervisor, Intel/NVIDIA vGPU, Linux kernel, OpenSSH, gcc SSP/ProPolice, Apache, Adobe Acrobat Reader, Xpdf, Torque GRID server, FreeBSD, and more) and studied exploitation and mitigation techniques, publishing results of his research in Phrack Magazine. @Adam_pi3 http://pi3.com.pl

Links:

• https://defcon.org/html/defcon-29/dc-29-speakers.html#zabrocki
• https://infocon.org/cons/DEF CON/DEF CON 29/DEF CON 29 presentations/Adam Zabrocki Alexander Matrosov - Glitching RISC-V chips - MTVEC corruption for hardening ISA.pptx
• https://infocon.org/cons/DEF CON/DEF CON 29/DEF CON 29 video and slides/DEF CON 29 - Adam Zabrocki Alexander Matrosov - Glitching RISC-V chips - MTVEC corruption for hardening ISA.mp4
• https://infocon.org/cons/DEF CON/DEF CON 29/DEF CON 29 presentations/Adam Zabrocki Alexander Matrosov - Glitching RISC-V chips - MTVEC corruption for hardening ISA.pdf (slides)
• https://infocon.org/cons/DEF CON/DEF CON 29/DEF CON 29 video and slides/DEF CON 29 - Adam Zabrocki Alexander Matrosov - Glitching RISC-V chips - MTVEC corruption for hardening ISA.srt (subtitles)
• https://www.youtube.com/watch?v=iz_Y1lOtX08

Similar Presentations:

• DEF CON 31 (2023) / Hacking The Metal: An Intro to ARM Assembly Language Programming Workshop