Attacking Hypervisors Using Firmware and Hardware
Intel Security researcher Yuriy Bulygin explores firmware and hardware emulation vulnerabilities in modern hypervisors, demonstrating SMM privilege escalation from guest VMs.
Summary
The Hardware Attack Surface of Hypervisors
As hypervisors increasingly underpin cloud and enterprise virtualization, vulnerabilities in physical system firmware (BIOS/UEFI) and hardware emulation expose host hypervisors to subversion.
Exploiting System Management Mode (SMM) and Firmware
Yuriy Bulygin analyzes firmware flaws that enable malicious guest virtual machines to escape isolation, triggering hypervisor denial of service, privilege escalation, and SMM code execution.
Firmware Rootkits and VM Content Inspection
Bulygin illustrates how low-level firmware rootkits can bypass hypervisor access controls to inspect hypervisor-protected data structures, including VMCS tables, EPT mappings, and IOMMU structures.
Extending CHIPSEC for Virtualization Auditing
The speaker releases new modules for the open-source CHIPSEC platform security framework, enabling security teams to test hardware virtualization and firmware protections against escape flaws.
Related talks
Main Stage·44 min
Enrique Nissim · Krzysztof Okupski
Enrique Nissim and Krzysztof Okupski disclose AMDSinkclose, a vulnerability allowing Ring -2 execution and System Management Mode takeover across millions of AMD processors.
Main Stage·40 min
Benny Zeltser · Jonathan Lusky
Benny Zeltser and Jonathan Lusky detail RingHopper, a multi-vendor UEFI vulnerability allowing user-space attackers to jump directly into System Management Mode (SMM).
Main Stage·52 min
Mickey Shkatov · Jesse Michael
Mickey Shkatov and Jesse Michael expose vulnerabilities in signed UEFI third-party bootloaders, demonstrating complete Secure Boot bypass across millions of PCs.