Post B6XPnRTGc66ZfJzZtw by jpm@aus.social
 (DIR) More posts by jpm@aus.social
 (DIR) Post #B6WprAFeyq7r4K6SkS by azonenberg@ioc.exchange
       0 likes, 0 repeats
       
       STMicro finally released a security advisory related to a silicon errata I found last year so I can talk more freely about it https://www.st.com/resource/en/security_bulletin/sb0070-risaf-limitation-about-pcie-region-protection-on-stm32mp25xx-stmicroelectronics.pdfTl;dr the STM32MP2 AXI firewall (RISAF)  does not fully block transactions to the PCIe region that are prohibited by register settings.Writes have the data replaced with 0x00, but still execute (so an attacker who should not be able to touch the device can write zeroes to any location in the BAR of their choice).Reads have the response data replaced with 0x00 as seen on the bus, but any side effects of the read like clearing flags or popping a fifo will still execute.In short, it seems to behave as though the AXI data channel is blocked but not the control channel.The security violation interrupt still fires so the trustzone monitor will be aware of the issue, but depending on the application it may be too late since the register write already happened.I found this by accident while trying to bring up the STM32MP2 bare metal and couldn't understand why all of my PCIe accesses were acting funny. So if anyone is wondering why I went dark all of a sudden on that side project, now you know why.
       
 (DIR) Post #B6WqFixDbnJXeABjwu by dtl@8bitorbust.info
       0 likes, 0 repeats
       
       @azonenberg was that your router project?
       
 (DIR) Post #B6WqFjJCI4tYkKTICu by azonenberg@ioc.exchange
       0 likes, 0 repeats
       
       @dtl no the switch uses a stm32h735 and is on hold just because I've been too busy to do final PCB signoff and order the FPGA board.This is research for a next gen platform.
       
 (DIR) Post #B6WtjZfuyKQ5Q01OVc by azonenberg@ioc.exchange
       0 likes, 0 repeats
       
       @dysfun i mean I'm sure it was *intended* to fully block the transaction...
       
 (DIR) Post #B6WwYNSWLnSACx6jJo by toader@fosstodon.org
       0 likes, 0 repeats
       
       @azonenberg @dtl how do you keep track of all your ongoing projects? Any special tool or simple todolists/text notes?
       
 (DIR) Post #B6WyPP8wv1VWjYnnyy by 0h00000000@ioc.exchange
       0 likes, 0 repeats
       
       @azonenberg You have to wonder if the source code has a comment like "//todo: demo only, need real implementation..."
       
 (DIR) Post #B6X1H0iS9fS0WH68X2 by azonenberg@ioc.exchange
       0 likes, 0 repeats
       
       @toader @dtl nope just my head and context switching whenever I feel like it or inspiration strikes
       
 (DIR) Post #B6X4PxLgLM7UXqP7dQ by wren6991@types.pl
       0 likes, 0 repeats
       
       @azonenberg Your description doesn't add up: the control flow signals on the data channels must still be driven too, else it would lock up. It almost sounds like they're just masking data low and RESP high
       
 (DIR) Post #B6X4Pxxy30kESaJhJI by whitequark@social.treehouse.systems
       0 likes, 0 repeats
       
       @wren6991 @azonenberg yep that's exactly my thoughts here
       
 (DIR) Post #B6X4Py8xO9XF0fSTRI by whitequark@social.treehouse.systems
       0 likes, 0 repeats
       
       @wren6991 @azonenberg i wonder if security was an afterthought and someone was like "well if we mask things like this, you don't have to re-verify the sequential logic!"
       
 (DIR) Post #B6X4PyHorCclS9bYFk by azonenberg@ioc.exchange
       0 likes, 0 repeats
       
       @whitequark @wren6991 lol maybe?
       
 (DIR) Post #B6X5DYtLY39xAinvWa by anymouse_404@glitch.social
       0 likes, 0 repeats
       
       @azonenberg My beefs with the MP2 are way more pedestrian. I fucked myself by choosing to use it for my thesis, and killed like a month by just trying to assign peripherals to the M33 context and run a program on it.Or that on the discovery board, the I2C bus that has HDMI and LVDS stuff on it, is shared with I2C on the GPIO header, when there was another perfectly good unused I2C available on two unconnected balls right there.
       
 (DIR) Post #B6XJANWakjQgPJXMjw by jpm@aus.social
       0 likes, 0 repeats
       
       @azonenberg @dysfun *stares in NetScaler*
       
 (DIR) Post #B6XJXTUIkSSzYtTkyu by jpm@aus.social
       0 likes, 0 repeats
       
       @dysfun @azonenberg I dunno, have you seen what all the “next-gen firewalls” (Palm Alto, FortiNet, SonicWall, et al) do? I’ve lost count of the number of CVEs on firewalls this year.
       
 (DIR) Post #B6XJXTpZTNTqcrQk8O by azonenberg@ioc.exchange
       0 likes, 0 repeats
       
       @jpm @dysfun yeeeah i have Opinions about such things
       
 (DIR) Post #B6XMHFfwdM93x9sgVM by AMS@infosec.exchange
       0 likes, 0 repeats
       
       @azonenberg Figured as much when you posted the zero'd transactions and trailed off with "that's funny."
       
 (DIR) Post #B6XPnRTGc66ZfJzZtw by jpm@aus.social
       0 likes, 0 repeats
       
       @azonenberg @dysfun ../ every time