STE WILLIAMS

Security researcher Kate Temkin has released proof-of-concept code dubbed Fusée Gelée that exploits a bug in Nvidia’s Tegra chipsets to run custom code on locked-down devices.

Temkin, who participates in the Nintendo Switch hacking project ReSwitched, has developed a cold-boot hack for the games console that takes advantage of an unpatchable blunder in the Tegra boot ROM.

She’s also working on customized Switch firmware called Atmosphère, which can be installed via Fusée Gelée.

Essentially, Fusée Gelée exploits a vulnerability during a Switch’s startup to commandeer the gadget and execute unofficial software. This is useful for unlocking the locked-down Nintendo Switch so that home-brew games, custom firmware, and other code can be run.

You’ll need physical access to the hardware during power-up to perform Fusée Gelée – it’s not something that can be pulled off over the air.

In a blog post outlining her findings earlier this month, Temkin explained: “The relevant vulnerability is the result of a ‘coding mistake’ in the read-only boot ROM found in most Tegra devices.”

Looking to nab Nvidia’s GeForce chips? You need cash and patience

READ MORE

Full details of the bug is set to be revealed on June 15, 2018, unless it is made public by others first – a parallel effort to create custom firmware for the Switch using the vulnerability, or one substantially similar, is underway by a group called Team Xecuter.

The vulnerability is said to affect Tegra chips prior to T186/X2, released in 2016, so it’s not just the Nintendo Switch that’s potentially vulnerable. Other gear using the affected chipset is also potentially at risk.

Temkin reckoned the issue is present in all Nintendo Switches. The nature of the flaw is such that it will require a hardware revision to fix. The boot ROM, which contains the programming bug, accepts minor patches in the factory but cannot be updated afterwards, according to Temkin. That means once a vulnerable machine rolls off of the assembly line, the vulnerability is baked in and cannot be mitigated.

Temkin said the cockup was responsibly disclosed to and forwarded to other vendors that use Tegra embedded processors, including Nintendo.

In a summary of her work, Temkin described Fusée Gelée as “a cold boot vulnerability that allows full, unauthenticated arbitrary code execution from an early boot ROM context via Tegra Recovery Mode (RCM) on Nvidia’s Tegra line of embedded processors.”

The issue is that the USB software stack in the Tegra boot ROM calls a memory copy function with a length parameter that can be defined by an attacker, allowing the processor’s execution stack to be overwritten by an oversized copy operation. It’s pretty much game over after that: now you can point the processor at whatever code you want having scribbled over its stack, which contains return addresses.

“By carefully constructing a USB control request, an attacker can leverage this vulnerability to copy the contents of an attacker-controlled buffer over the active execution stack, gaining control of the Boot and Power Management processor (BPMP) before any lock-outs or privilege reductions occur,” Temkin’s paper explained.

Successful exploitation compromises the processor’s root-of-trust and provides the attacker with access to secrets burned into device fuses, as well as allowing arbitrary code execution.

An Nvidia spokesperson declined to comment when prodded by The Register. ®

Sponsored:
Minds Mastering Machines – Call for papers now open

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2018/04/23/nintendo_switch_nvidia_tegra_boot_rom_flaw/