Privileged firmware mode protection
In one embodiment, a method includes accessing a request from a lower privileged process executing on a computing device to access a privileged firmware mode of the computing device and accessing a set of access policies for detecting whether the request is an unauthorized access to the privileged firmware mode. The method further includes determining, based on at least part of a content of the request and on the set of access policies, whether the request to access a privileged firmware mode is authorized; and denying or permitting, based on the determination, access by the lower privileged process to the privileged firmware mode.
1. A method comprising:
accessing a request from a lower privileged process executing on a booted computing device operating a processor in a lower-privileged mode, wherein the request is to access a privileged firmware mode of the booted computing device in which the processor operates in a full-privileged mode having full access to the booted computing device's systems and resources, wherein the privileged firmware mode comprises one or more active system management interrupts;
accessing a set of access policies for detecting whether the request is an unauthorized access to the privileged firmware mode;
determining, prior to operating the booted computing device in the privileged firmware mode and based on at least part of a content of the request and on the set of access policies, whether the request to access the privileged firmware mode comprising the one or more active system management interrupts is authorized; and
denying or permitting, based on the determination, access by the lower privileged process to the privileged firmware mode.
2. The method of claim 1 , wherein the request from the lower privileged process comprises a request from an operating system executing on the computing device.
3. The method of claim 1 , wherein the request is accessed from a shared communication buffer on the computing device used for communications between the lower privileged process and the privileged firmware mode.
4. The method of claim 1 , wherein the set of policies includes one or more allow-based rules that specifies a request will be permitted when the request comprises specific predetermined content.
5. The method of claim 1 , wherein the set of policies includes one or more deny-based rules that specifies a request will be denied when the request comprises specific predetermined content.
6. The method of claim 1 , wherein the privileged firmware mode is a system management mode.
7. The method of claim 1 , wherein the request from a lower privileged process to access a privileged firmware mode of a computing device comprises a request to access a service provided by a system management interrupt.
8. The method of claim 1 , wherein determining, based on at least part of a content of the request and on the set of access policies, whether the request to access a privileged firmware mode is authorized comprises determining whether particular data in the request matches known data or determining whether a particular pattern of bytes in the request matches a known pattern.
9. The method of claim 1 , further comprising updating the set of access policies without restarting the computing device.
10. The method of claim 1 , wherein the set of access policies are stored in a secured area of the firmware.
11. One or more non-transitory computer readable storage media embodying instructions and coupled to one or more processors that are operable to execute the instructions to:
access a request from a lower privileged process executing on a booted computing device operating a processor in a lower-privileged mode, wherein the request is to access a privileged firmware mode of the booted computing device in which the processor operates in a full-privileged mode having full access to the booted computing device's systems and resources, wherein the privileged firmware mode comprises one or more active system management interrupts;
access a set of access policies for detecting whether the request is an unauthorized access to the privileged firmware mode;
determine, prior to operating the booted computing device in the privileged firmware mode and based on at least part of a content of the request and on the set of access policies, whether the request to access the privileged firmware mode comprising the one or more active system management interrupts is authorized; and
deny or permit, based on the determination, access by the lower privileged process to the privileged firmware mode.
12. The media of claim 11 , wherein the request from the lower privileged process comprises a request from an operating system executing on the computing device.
13. The media of claim 11 , wherein the request is accessed from a shared communication buffer on the computing device used for communications between the lower privileged process and the privileged firmware mode.
14. The media of claim 11 , wherein the set of policies includes one or more allow-based rules that specifies a request will be permitted when the request comprises specific predetermined content.
15. The media of claim 11 , wherein the set of policies includes one or more deny-based rules that specifies a request will be denied when the request comprises specific predetermined content.
16. A system comprising one or more processors and a non-transitory computer readable storage media embodying instructions coupled to the one or more processors, the one or more processors operable to execute the instructions to:
access a request from a lower privileged process executing on a booted computing device operating a processor in a lower-privileged mode, wherein the request is to access a privileged firmware mode of the booted computing device in which the processor operates in a full-privileged mode having full access to the booted computing device's systems and resources, wherein the privileged firmware mode comprises one or more active system management interrupts;
access a set of access policies for detecting whether the request is an unauthorized access to the privileged firmware mode;
determine, prior to operating the booted computing device in the privileged firmware mode and based on at least part of a content of the request and on the set of access policies, whether the request to access the privileged firmware mode comprising the one or more active system management interrupts is authorized; and
deny or permit, based on the determination, access by the lower privileged process to the privileged firmware mode.
17. The system of claim 16 , wherein the request from the lower privileged process comprises a request from an operating system executing on the computing device.
18. The system of claim 16 , wherein the request is accessed from a shared communication buffer on the computing device used for communications between the lower privileged process and the privileged firmware mode.
19. The system of claim 16 , wherein the set of policies includes one or more allow-based rules that specifies a request will be permitted when the request comprises specific predetermined content.
20. The system of claim 16 , wherein the set of policies includes one or more deny-based rules that specifies a request will be denied when the request comprises specific predetermined content.