In more detail, TXT has an instruction called SENTER. It loads a signed chunk of code into the cache and locks out all RAM accesses. It verifies a signature on

In more detail, TXT has an instruction called SENTER. It loads a signed chunk of code into the cache and locks out all RAM accesses. It verifies a signature on the code and if it is valid, jumps to it. Behind the scenes, it also resets the TPM's hash registers (PCRs) to their initial state. Only Intel can supply an AC (authenticated code) module since only they have the signing key. The AC module is typically stored in the BIOS, so this bug would be fixed by a BIOS update. The default AC module just initializes the system to a state where no other code can affect it, hashes the next level bootloader into a PCR, and jumps to it. Since no one can reset PCRs without running SENTER, programs can use the contents of the PCRs to see what code is running. The biggest issue with this advisory is that there is no way to revoke old AC modules that I know of. So an attacker could always run SENTER with the old AC, compromise it, then boot the real hypervisor. When that hypervisor tries to access the PCRs, the rootkit can virtualize them. No one later in the chain can tell the difference. This is a fundamental problem with trusted boot in general -- any time a flaw is found in one link in the chain, everyone after it is compromised.