Exploiting an I/OMMU vulnerability

It is difficult to protect an operating system kernel in an efficient way. Attackers can corrupt or subvert it by two different means: (1) the CPU; (2) the Direct Memory Access (DMA) capability of I/O controllers. DMA-based attacks can be blocked using an I/OMMU. This component, embedded in most of current chipsets, enables the operating system to virtualize the main memory for I/O controllers and to restrict their access to only some memory regions. In this paper, we present different vulnerabilities we identified on Intel VT-d, which implements an I/OMMU. An example of exploitation of one of them is then detailed. Finally, we give some recommendations to prevent these vulnerabilities from being used for malicious purposes.