System and method for firmware security event mitigation
Systems and methods for performing security event mitigation with firmware are discussed. A firmware-based security event framework receives notifications of security events occurring in a firmware-controlled operating environment on a computing platform, logs information related to the event and optionally performs mitigation operations to address the security event.
1. A non-transitory medium holding executable instructions for performing security event mitigation with firmware on a computing platform equipped with one or more processors, the instructions when executed causing the computing platform to:
receive notification of detection of an occurrence of a security event occurring within a privileged firmware-controlled operating environment running outside the control of a main hypervisor or operating system on the computing platform, the detection occurring during runtime following completion of a boot sequence for the computing platform and a transition of control to the privileged firmware-controlled operating environment from the main hypervisor or operating system,
wherein the security event detected is one of unauthorized memory access, unauthorized register access, unauthorized use of specified privileged instructions, buffer overflow or integer arithmetic faults;
log, with the firmware, information regarding the cause of the event in a non-volatile storage location;
generate, with the firmware, a notification of the security event;
reset the computing platform based on the detection before performing a mitigation of the security event and
perform, with the firmware, a mitigation of the security event after the resetting of the computing platform.
2. The medium of claim 1 , wherein the mitigation blocks a firmware module from executing after the reset of the computing platform.
3. The medium of claim 1 , wherein the mitigation re-flashes an entire BIOS image, a firmware volume that contains a module causing the security event, or a specific driver causing the security event.
4. The medium of claim 1 , wherein the security event is caused by code executing when one or more processors of the computing platform are in System Management Mode.
5. The medium of claim 1 , wherein the security event is detected using central processing unit and chipset resources.
6. The medium of claim 1 , wherein the security event is detected at runtime using code injected by a compiler during build time.
7. A method for performing security event mitigation with firmware on a computing platform equipped with one or more processors, comprising:
receiving notification of detection of an occurrence of a security event occurring within a privileged firmware-controlled operating environment running outside the control of a main hypervisor or operating system on the computing platform, the detection occurring during runtime following completion of a boot sequence for the computing platform and a transition of control to the privileged firmware-controlled operating environment from the main hypervisor or operating system,
wherein the security event detected is one of unauthorized memory access, unauthorized register access, unauthorized use of specified privileged instructions, buffer overflow or integer arithmetic faults;
logging, with the firmware, information regarding the cause of the event in a non-volatile storage location;
generating, with the firmware, a notification of the security event;
resetting the computing platform based on the detection before performing a mitigation of the security event; and
performing, with the firmware, a mitigation of the security event after the resetting of the computing platform.
8. The method of claim 7 , wherein the mitigation blocks a firmware module from executing after the reset of the computing platform.
9. The method of claim 7 , wherein the mitigation re-flashes an entire BIOS image, a firmware volume that contains a module causing the security event, or a specific driver causing the security event.
10. The method of claim 7 , wherein the security event is caused by code executing when one or more processors of the computing platform are in System Management Mode.
11. The method of claim 7 , wherein the security event is detected using central processing unit and chipset resources.
12. The method of claim 7 , wherein the security event is detected at runtime using code injected by a compiler during build time.
13. A computing platform, comprising:
one or more processors; and
firmware including a security event framework, the security event framework including one or more firmware modules that when executed:
receive notification of an occurrence of a security event occurring within a privileged firmware-controlled operating environment running outside the control of a main hypervisor or operating system on the computing platform, the detection occurring during runtime following completion of a boot sequence for the computing platform and a transition of control to the privileged firmware-controlled operating environment from the main hypervisor or operating system,
wherein the security event detected is one of unauthorized memory access, unauthorized register access, unauthorized use of specified privileged instructions, buffer overflow or integer arithmetic faults;
log, with the firmware, information regarding the cause of the event in a non-volatile storage location;
generate, with the firmware, a notification of the security event;
reset the computing platform based on the detection before performing a mitigation of the security event; and
perform, with the firmware, a mitigation of the security event.