3 ms·

Is there a security story for this interface? Internal NVMe devices are generally trusted and not passed around, but plugging untrusted things directly into the

by jrk 9y ago

Is there a security story for this interface? Internal NVMe devices are generally trusted and not passed around, but plugging untrusted things directly into the PCIe bus, with coherent access to memory, is a potentially huge security hole. This was an issue with early Thunderbolt. And this isn't very hypothetical: aside from passing cards around, counterfeit SD cards are extremely common on Amazon.

goldenkey 9y ago
This seems to be just the prototype. Ideally, the production version would have the PCIe interface reader hardware on the system itself, and the SD Card would merely expose some bus pins. Another solution might be keeping the PCIe interface on the SD card but adding a small proxy in the reader to restrict the PCIe protocol - but this might incur a non-negligable performance hit.
the8472 9y ago
IOMMUs can protect the RAM if configured to do so by the OS, udevd rules could let you opt-in to to the kernel using the devices - you wouldn't want your network connections hijacked through some plugged-in and auto-detected network device! But I don't know what the PCIe security model is wrt. to accessing other devices, such as the HDDs.
- monocasa 9y ago
  > But I don't know what the PCIe security model is wrt. to accessing other devices, such as the HDDs. Should also be protected by the MMU for the most part. You might be able to forge interrupts from other devices though. PCI-E message signaled interrupts are just another memory write to a special part of address space, that unfortunately isn't separated by device at page granularity AFAIR.
SahAssar 9y ago
> This was an issue with early Thunderbolt. Still is, right? It's an issue with any interface that has DMA like firewire and thunderbolt.
cjbprime 9y ago
What's wrong with IOMMUs?
mankash666 9y ago
Except every peripheral in the Apple ecosystem uses Thunderbird/Pcie. This is as much of a security threat as any peripheral available today

by jrk 9y ago

goldenkey 9y ago

This seems to be just the prototype. Ideally, the production version would have the PCIe interface reader hardware on the system itself, and the SD Card would merely expose some bus pins. Another solution might be keeping the PCIe interface on the SD card but adding a small proxy in the reader to restrict the PCIe protocol - but this might incur a non-negligable performance hit.

the8472 9y ago

IOMMUs can protect the RAM if configured to do so by the OS, udevd rules could let you opt-in to to the kernel using the devices - you wouldn't want your network connections hijacked through some plugged-in and auto-detected network device! But I don't know what the PCIe security model is wrt. to accessing other devices, such as the HDDs.

monocasa 9y ago
> But I don't know what the PCIe security model is wrt. to accessing other devices, such as the HDDs. Should also be protected by the MMU for the most part. You might be able to forge interrupts from other devices though. PCI-E message signaled interrupts are just another memory write to a special part of address space, that unfortunately isn't separated by device at page granularity AFAIR.

SahAssar 9y ago

> This was an issue with early Thunderbolt. Still is, right? It's an issue with any interface that has DMA like firewire and thunderbolt.

cjbprime 9y ago

What's wrong with IOMMUs?

mankash666 9y ago

Except every peripheral in the Apple ecosystem uses Thunderbird/Pcie. This is as much of a security threat as any peripheral available today