DEF CON 29 - Laura Abbott, Rick Altherr -Breaking TrustZone M: Privilege Escalation on LPC55S69

The concept of Trusted Execution Environments has been broadly introduced to microcontrollers with ARM’s TrustZone-M. While much experience with TrustZone-A can be applied, architectural differences with ARMv8-M lead to a very different approach to configuration and transitions between secure and non-secure worlds. This talk will deep dive into how TrustZone-M works, where to look for weaknesses in implementations, and a detailed look into NXP LPC55S69’s implementation including discovering an undocumented peripheral that leads to a priviledge escalation vulnerability exploitable with TrustedFirmware-M. Finally, NXP PSIRT will be used as a case study in how _not_ to respond to a vulnerability report.

REFERENCES:

[gertvbiljon]

Thanks Laura and Rick!

I learned more about the security on the LPC55s69 from this presentation than from reading the manual.

Till now, I really liked the chip, particularly as it contains the Powerquad DSP processor which makes the work I do analyzing the Amps and Volts waveforms coming back from electric motors used in irrigation a breeze

Starting to think that the open source Risc-V chips will be the future architechture I will use?

Thanls plenty!

[jimgolab]

I SPECULATE that the reason that the one section was removed from the users manual was that the chip implementation had a bug, and it was easier to just not support the feature at all, rather than to errata and fix it. This is usually a marketing decision about how many sales will be lost by not having the feature.

[narimanP]

Thanks for the great presentation! Just a heads up there is an error on the slide at 7:08, it incorrectly lists EL0-4. There are 4 exception levels in Cortex-A 0-3, 0-4 would be 5 exception levels.

[u-ux]

What is an "Application Note" she keeps mentioning at the start of the presentation?

[victoriabirch]

Allen Anthony Wilson Kevin Moore Michelle