SWITCH BUG found in v5.02 - TSEC firmware compromises itself!

SWITCH BUG found in v5.02 - TSEC firmware compromises itself!

May 5th, 2018, 10:55 Posted By: wraggster

More Switch News:

Scene developer @hexkyz recently updated the 'SwitchBrew Wiki', to document the 'TegraRCM' in full, and at the same time dropped a rather useless (but hilarious) 'unpatchable' bug.

- That he found in the 'TSEC firmware' for v5.02 that not very useful but still its there:

Package1ldr loads a firmware blob into TSEC early on boot. This piece of code runs on the TSEC in Authenticated Mode and has the sole purpose of generating the per-console TSEC key (see Cryptosystem).

As a way to mitigate attacks, the TSEC firmware blob is split into 3 stages: Stage 0 which is unencrypted and unsigned, Stage 1 which is unencrypted but signed and Stage 2 which is encrypted and signed. Stage 0 loads a static pre-generated signature into the Falcon's CPU crypto registers, loads Stage 1 into the Falcon's CODE region and jumps to it. Execution will proceed into Stage 1 in Authenticated Mode if, and only if, the loaded signature matches the one Falcon calculates internally for Stage 1.

Among various things, Stage 1 will attempt to do a "backwards" security check by calculating a CMAC over Stage 0 and comparing it with a known hash stored in the TSEC firmware's key data (a small buffer stored after Stage 0's code). If the hashes don't match, execution aborts.

Stage 1 stores the calculated Stage 0's CMAC in the stack, but forgets to clear it. Since the stack is located in Falcon's DATA region, loading the TSEC firmware blob and dumping the DATA region afterwards (via MMIO) will reveal the calculated hash. This allows using Stage 1 as an oracle to generate a valid CMAC for arbitrary Stage 0 code. Replacing the CMAC in the TSEC firmware's key data region results in Stage 1 accepting any Stage 0 code, thus rendering this security measure useless.

Additionally, since signed Falcon code can't be revoked without an hardware revision, an attacker can always reuse the flawed Stage 1 code even if a fix is issued.

OFFICIAL SITE: --> http://switchbrew.org/index.php?titl...541&oldid=4515

NEWS SOURCE: @hexkyz (via) Twitter

via http://www.maxconsole.com/threads/switch-bug-found-in-v5-02-tsec-firmware-compromises-itself.46910/

For more information and downloads, click here!