Pandora's Box in Your SSD: The Untold Dangers of NVMe

Rick Wertenbroek,Alberto Dassatti

2024-11-01

Abstract:Modern operating systems manage and abstract hardware resources, to ensure efficient execution of user workloads. The operating system must securely interface with often untrusted user code while relying on hardware that is assumed to be trustworthy. In this paper, we challenge this trust by introducing the eNVMe platform, a malicious NVMe storage device. The eNVMe platform features a novel, Linux-based, open-source NVMe firmware. It embeds hacking tools and it is compatible with a variety of PCI-enabled hardware. Using this platform, we uncover several attack vectors in Linux and Windows, highlighting the risks posed by malicious NVMe devices. We discuss available mitigation techniques and ponder about open-source firmware and open-hardware as a viable way forward for storage. While prior research has examined compromised existing hardware, our eNVMe platform provides a novel and unique tool for security researchers, enabling deeper exploration of vulnerabilities in operating system storage subsystems.

Cryptography and Security,Hardware Architecture

What problem does this paper attempt to address?

The problem that this paper attempts to solve is the security threats brought by NVMe solid - state drives (SSDs) as a potential attack vector in modern computer systems. Specifically, by introducing a malicious NVMe platform named eNVMe, the paper reveals the vulnerabilities existing in current operating systems and hardware architectures and shows how to use these vulnerabilities to attack the target system. The following are the specific problems that the paper attempts to solve:

1. **Challenging existing trust assumptions**:
- Modern operating systems assume that hardware is trustworthy while user code may be untrustworthy. The paper challenges this assumption by constructing a malicious NVMe device (eNVMe), proving that there is a risk of being tampered with even at the hardware level.

2. **Revealing the security risks of NVMe SSDs**:
- NVMe SSDs have powerful computing capabilities and direct memory access (DMA) functions, which make them potential large - scale attack and cyber - warfare weapons. The paper shows through actual cases the serious consequences that these devices may bring, such as data destruction, system control acquisition, privacy leakage, etc.

3. **Providing research tools and methods**:
- The paper proposes a low - cost, open - source research platform eNVMe, enabling security researchers to deeply explore the possibility of NVMe SSDs as an attack vector. This platform not only helps researchers understand the vulnerabilities of existing systems but also provides a basis for developing new protection measures.

4. **Promoting the development of transparent and secure storage systems**:
- By showing the potential risks of NVMe SSDs, the paper calls on the industry to pay attention to the security of storage devices and promotes the development of open - source firmware and hardware to improve the overall system security.

### Main contributions

- **eNVMe platform**: A low - cost, fully open - source platform for exploring the security implications of malicious NVMe devices.
- **Attack demonstrations**: Demonstrates multiple reproducible attack scenarios, proving the vulnerability of many existing systems to storage - specific attacks.
- **Discussion of mitigation techniques**: Discusses existing mitigation techniques and their limitations and proposes directions for future improvement.

### Formula representation

In this paper, the technical details and attack vectors involved mainly depend on hardware and software mechanisms rather than specific mathematical formulas. Therefore, no complex mathematical formulas are used in the paper. If there is a need to express technical details, the following format can be referred to:

For example, when describing DMA operations, the following pseudo - code can be used:

```markdown
```python
# Example of DMA read operation
def dma_read(address, size):
data = read_physical_memory(address, size)
return data

# Example of DMA write operation
def dma_write(address, data):
write_physical_memory(address, data)
```
```

In short, the paper aims to reveal the security risks of storage devices in modern computer systems by constructing and testing malicious NVMe devices and to provide tools and support for future security research.