Nintendo Switch users could be cracked after unpatchable flaw found in Nvidia Tegra chips
Security researcher Kate Temkin has released proof-of-concept code to launch an exploit chain called Fusée Gelée, which relies on an as-yet-undisclosed vulnerability in past versions of Nvidia’s Tegra system-on-a-chip.
Temkin, who participates in the Nintendo Switch hacking project ReSwitched, has developed a cold boot hack for the device that takes advantage of the supposed Tegra flaw. She’s also working on customized Switch firmware called Atmosphére, which will be installable through Fusée Gelée.
In a blog post outlining her findings earlier this month, Temkin explains, “The relevant vulnerability is the result of a ‘coding mistake’ in the read-only boot ROM found in most Tegra devices.”
Looking to nab Nvidia’s GeForce chips? You need cash and patience
The bug is expected to be revealed on June 15, 2018, unless it is made public by others first – a parallel effort to create custom firmware for the Switch using the vulnerability, or one substantially similar, is underway by a group called Team Xecuter.
The vulnerability is said to affect Tegra chips prior to T186/X2 (released in 2016), so it’s not just the Nintendo Switch that’s potentially vulnerable.
Temkin claims the issue affects all current Nintendo Switch firmware versions. She also suggests that the flaw she identified isn’t necessarily the only vulnerability that has been found.
The nature of the flaw is such that it will require a hardware revision to fix. The boot ROM accepts minor patches in the factory but cannot be updated afterwards, according to Temkin.
Temkin says the vulnerability was responsibly disclosed to and forwarded to other vendors that use the Tegra embedded processor, including Nintendo.
In a summary of her findings, Temkin describes Fusée Gelée as “a cold boot vulnerability that allows full, unauthenticated arbitrary code execution from an early boot ROM context via Tegra Recovery Mode (RCM) on Nvidia’s Tegra line of embedded processors.”
The issue is that the USB stack in the Tegra boot ROM contains a copy operation with a length parameter that can be set by the attacker.
“By carefully constructing a USB control request, an attacker can leverage this vulnerability to copy the contents of an attacker-controlled buffer over the active execution stack, gaining control of the Boot and Power Management processor (BPMP) before any lock-outs or privilege reductions occur,” Temkin’s paper explains.
Successful exploitation compromises the processor’s root-of-trust and provides the attacker with access to secrets burned into device fuses.
The Register asked Nvidia to comment but the company declined. ®
Sponsored:
Minds Mastering Machines – Call for papers now open
Article source: http://go.theregister.com/feed/www.theregister.co.uk/2018/04/23/nvidia_tegra_flaw/