Another Way to Circumvent Intel ® Trusted Execution Technology

Earlier this year our team has presented an attack against Intel® TXT that exploited a design problem with SMM mode being over privileged on PC platforms and able to interfere with the SENTER instruction. This time we present a different attack that allows an attacker to trick the SENTER instruction into misconfiguring the VT-d engine, so that it doesnʼt protect the newly loaded MLE. This attack exploits implementation flaws in a so called SINIT module. keywords: Intel TXT, Intel VT-d, SINIT, SENTER, Trusted Boot, Attack, Circumvention