Memory Protection Unit: Is It Secure Enough? – PlaxidityX Ep 15

00:00:00:11 - 00:00:03:14 Welcome to cars, hackers and cybersecurity. 00:00:04:03 - 00:00:07:03 Here we break down the latest in automotive cybersecurity, 00:00:07:03 - 00:00:10:17 helping you stay ahead in building secure connected vehicles. 00:00:12:18 - 00:00:44:08 Hi. Today we'll dive into how deploying a careful memory protection unit configuration can enhance safety, and why ignoring MPU flaws could prove costly. As you're listening to these very words. It is certain that the very device facilitating this interaction is equipped with a memory management unit or MMU. Often overlooked but indispensable, important muse or the unsung heroes of modern computing, silently managing memory resources and ensuring the smooth operation of the software we rely on daily, 00:00:44:10 - 00:00:47:20 Unknown Including the one you are using to listen to this episode now. 00:00:47:20 - 00:00:53:13 from your smartphone to the powerful servers that drive the internet, muse, or at the heart of it all. 00:00:53:15 - 00:01:17:06 Orchestrating memory allocation, optimizing performance, and safeguarding against security vulnerabilities. Unfortunately, this episode will not be about muse simply because muse are usually not implemented in the microcontroller units. Also known as MCAs, which are at the heart of the majority of automotive electronic control units known as ECUs. 00:01:17:06 - 00:01:21:16 Instead. This episode is about the Emperor or Memory Protection Unit. 00:01:21:23 - 00:01:26:20 which may be likened to the younger, underrated sibling of the MMU. 00:01:26:22 - 00:01:43:10 While muse often receive more attention due to their central role in memory management of central processing units, MPAs play a crucial but sometimes overlooked role in enforcing memory protection, preventing unauthorized access, and safeguarding against security threats. 00:01:43:20 - 00:02:13:18 From muse to MPAs in modern central processing units. Muse are typically hardware devices used as virtual address space managers, mapping virtual addresses to physical ones. Muse generally perform additional memory related tasks as well. Muse memory protection is designed to block attempts by a program to access memory it has not previously requested, which prevents a misbehaving program from using up all memory or malicious code from reading and writing data of other programs. 00:02:13:20 - 00:02:23:12 Early microprocessor designs, such as the IBM system 360 from 1965 and the Apple Macintosh from 1986, 00:02:23:12 - 00:02:26:12 All included moves for handling virtual memory mapping. 00:02:26:12 - 00:02:42:04 and memory access permissions. Smaller microcontrollers, however, did not require the virtual memory mapping overhead of the MMU, but one weakness of microcontrollers architecture was the use of a common memory for operating system, user, software and variables. 00:02:42:06 - 00:03:07:16 This became even more difficult when multiple core microcontrollers began storming the market, where multiple applications in different security and safety levels are using the same common memory. Those applications that required a higher level of security, such as the automotive industry, implemented a downsized version of the MMU that only managed memory access permissions. This was the beginning of the Memory Protection Unit, or MPU, 00:03:08:01 - 00:03:09:10 the MPU. 00:03:09:12 - 00:03:45:22 A modern day Cyber Sentinel, a memory protection Unit is a programable hardware unit that acts as a gatekeeper of memory. It enables the user to divide the memory into different regions and set memory access permissions, privileged access only or full access, etc. and memory attributes read, write, execute to each of these regions in very basic terms. MPAs oversee access control to the memory resource, while access control is defined as a, quote, security technique that regulates who or what can view or use resources in a computing environment, unquote. 00:03:46:00 - 00:04:12:12 It is a fundamental concept in security that minimizes risk to organizations in a broad sense, as mentioned in computer security principles, in practice. All computer security is concerned with access control. Access control implements a security policy that specifies who or what may have access to each specific system resource, and the type of access that is permitted in each instance, 00:04:12:12 - 00:04:13:17 unquote. 00:04:13:19 - 00:04:25:20 In that sense, an employee is one of the main safeguards of security in general and in embedded systems in particular. Automotive included one research from Mude MPU 00:04:25:20 - 00:04:28:20 Adaptation of the Pip kernel to constrain devices. 00:04:28:20 - 00:04:50:14 demonstrated that although activating an EMP, you in a microcontroller causes a 16% overhead on both performance and energy consumption, it reduces the attack surface of the accessible application memory from 100% down to 2% in attempt to access unauthorized memory results in a hardware fault, which effectively stops the potential attack 00:04:50:14 - 00:04:54:01 And handles the unauthorized access, for example. 00:04:54:01 - 00:04:59:11 by resetting the system and shaking off the attacker. An MP you, once enabled, 00:04:59:11 - 00:05:03:06 May restrict execution access on random access memories of rams. 00:05:03:06 - 00:05:18:05 So although a first stage of attack writing the malicious exploit code into target's EC2 stack memory using the stack buffer overflow vulnerability is successful execution of that code on the stack memory area failed due to MPU protection. 00:05:18:05 - 00:05:45:18 Protection units in the automotive domain. Memory protection units play a crucial role in the automotive market by enhancing the security, reliability, and safety of embedded systems within vehicles. Here's a summary of their role. MPAs contribute to automotive cyber security systems by implementing and enforcing memory protection mechanisms. These help prevent unauthorized access, data corruption or unintended execution of code. 00:05:45:20 - 00:05:49:11 Safeguarding critical information and functions from external threats. 00:05:49:17 - 00:06:15:04 MPAs can differentiate between different privilege levels and strictly enforced, predetermined access control policies. Automotive applications frequently use components with different privilege levels, such as the hardware security module or HSM. The bootloader application secure boot processes, and third party applications. The ability to block memory access is directed to the HSM memory by unauthorized applications. 00:06:15:04 - 00:06:20:12 For example, is a crucial security tool in the hands of the automotive system architect. 00:06:20:17 - 00:06:22:19 Safety is enhanced by MPAs. 00:06:22:19 - 00:06:42:17 MPAs assist in creating safety critical systems by enforcing memory protection policies, isolating critical software components, and reducing the risk of errors or malicious interference that could compromise vehicle safety. MPAs enable the isolation of different applications within the vehicle's embedded systems. 00:06:42:23 - 00:07:13:08 Each application or software module can be allocated its own protected memory space, preventing unintended interference or data corruption between applications. This isolation is essential for maintaining the integrity of critical functions and ensuring that successful attacks on one application do not impact others. In the same system. Memory protection units play a pivotal role in managing and securing the interactions of bus masters within a system, including cause, direct memory access or DMA 00:07:13:08 - 00:07:20:16 controllers and core external peripheral controllers such as can USB GPUs, and so on. 00:07:20:17 - 00:07:56:04 In the context of bus masters, MPAs act as critical components, ensuring the integrity and security of data transfers by providing memory protection mechanisms. MPAs enable the isolation of different bus masters, preventing unintended interference and potential conflicts in accessing shared memory. This capability is especially crucial in multicore systems, where various cores may concurrently access memory resources. MPAs contribute to the establishment of secure and well-defined boundaries, allowing each bus master to operate within its allocated memory space. 00:07:56:06 - 00:08:20:00 MPAs enforce access controls to safeguard against unauthorized or malicious activities, ensuring the confidentiality and integrity of data during high speed extra core transfers. Types of MPAs. Not all memory protection units are cut of the same cloth, and depending on architecture, we may see a variety of them. However, we can generalize and describe the three main types. 00:08:20:12 - 00:08:25:23 one CPU, also known as core MCU or CPU and GPU. 00:08:25:23 - 00:08:46:18 is a memory protection unit integrated directly into each of the cause of the microcontroller. It operates at the core level, providing fine grained memory protection and access control mechanisms. The CPU enables the enforcement of memory protection policies for code and data accesses initiated by the core itself. It typically supports setting access permissions 00:08:46:18 - 00:08:52:19 like read, write, and execute, and privilege levels per each multiple memory regions. 00:08:52:21 - 00:09:00:10 CPUs are essential for securing memory access of individual software processes running on each of the microcontrollers cores. 00:09:00:10 - 00:09:04:18 Two SMP you, also known as system MPU 00:09:04:18 - 00:09:06:13 Is a memory protection unit. 00:09:06:13 - 00:09:26:12 designed to protect the entire system memory space. Unlike CPU, which provides protection from the cores perspective, SMP CPU operates at the system level and provides memory protection from bus transactions within the system, while core MPAs monitor and control bus transactions originating from software code running on the cores. 00:09:26:14 - 00:09:54:01 The system MPU enforces control over bus transactions across the entire system, including hardware related mechanisms such as direct memory access, HSM, etc. the SMP you address regions are usually defined by the source of the bus transaction. For example, the SMP, you may be configured to allow access to a specific address range and shared memory to the HSM while blocking all other bus transactions originating from other sources. 00:09:54:11 - 00:09:55:09 three 00:09:55:19 - 00:09:58:21 Pu, also known as peripheral MCU. 00:09:58:21 - 00:10:23:19 is a specialized memory protection unit dedicated to protecting memory mapped registers within the embedded system. CPU provides access control and security features specifically tailored for peripherals such as communication interfaces, timers, and IO ports. It allows for the enforcement of access permissions and restrictions on peripheral accesses initiated by the processor cores or external bus masters. 00:10:23:21 - 00:10:32:08 CPU enhances the security and reliability of peripheral interactions, preventing unauthorized or malicious access to critical system peripherals. 00:10:32:20 - 00:11:08:08 A carefully configured memory protection unit would prove to be a strong opposition to any attacker. However, as the cliche says, any chain is as weak as its weakest link. If an attacker is capable of disabling a perfectly configured MP, you naturally the protecting characteristics of the MP you simply fade away. These two vulnerabilities, CVE 2023 48010 and CVE 2024 33882 are both hardware vulnerabilities we identified relating to a specific design of power PC microcontrollers. 00:11:08:10 - 00:11:22:21 They allow a privileged attacker to shut off the entire SMP, which stands for System Memory Protection Unit, and so allow, read and write access to protected memory areas. Although according to the data sheet of the PowerPC microcontroller, 00:11:22:21 - 00:11:29:16 A certain hardware feature should have ensured that the SMP U remained enabled after its initial configuration. 00:11:29:16 - 00:11:32:09 Even if an attacker attempted to disable the SNP. 00:11:32:09 - 00:11:54:07 You. It has become apparent that this feature is not actually implemented in the silicon as claimed, thus leaving the SNP vulnerable to such attacks. Consequently, the software's designer may remain under the impression that by taking the measures detailed in the data sheet, they are protected, completely unaware of the actual lack of protection and the risk to their system. 00:11:54:09 - 00:12:31:21 Some background the PowerPC architecture, the first PowerPC microcontroller, was manufactured by Motorola, which later became Freescale Semiconductor in the mid 1990s. These micro controllers, known as the MPC five series, marked the initial foray of PowerPC architecture into the embedded systems market, including automotive applications. The roots of the MPC five X family can be traced back to the collaborative efforts of IBM, Apple, and Motorola in the early 1990s with its risk based design offering a blend of performance and efficiency. 00:12:31:23 - 00:12:59:21 The first PowerPC processors found their way into automotive systems by the late 1990s. Initially employed for tasks like engine and transmission control, their real time processing capabilities, and robustness in harsh conditions quickly made them indispensable for a wide array of applications, from infotainment systems to advanced driver assistance systems. Around the mid 2000, a joint collaboration between STMicroelectronics 00:12:59:21 - 00:13:01:09 And Freescale Semiconductor, 00:13:01:12 - 00:13:03:14 now NXP semiconductors. 00:13:03:14 - 00:13:07:06 resulted in the development of the MPC 56XX 00:13:07:06 - 00:13:07:18 Unknown and 00:13:07:18 - 00:13:10:05 SPC 56X family. 00:13:10:07 - 00:13:23:07 Based on the power PC architecture specifically designed for automotive applications in both manufacturers, the packages are pin to pin compatible and the microcontrollers are almost identical. 00:13:23:07 - 00:13:24:15 The vulnerabilities. 00:13:24:15 - 00:13:52:11 On top of automotive penetration testing and security research, we at plac sit ATX design and develop security products and solutions for automotive systems. In our case, we developed a proof of concept, or POC for a future product. As part of the evaluations we do before choosing a system to work with. We based the POC on the PowerPC SPC 58 N family of microprocessors from STMicroelectronics. 00:13:52:11 - 00:14:11:08 mainly because, as said above, these microcontrollers have been specifically designed for automotive applications and are extensively used. The SPC 58 N is a triple core, 32 bit power architecture microcontroller for automotive, Asil, D and security applications. 00:14:11:10 - 00:14:21:13 The chip's memories include flash, Prom and static Ram. These memories are by definition commonly accessible by all cores and peripherals. 00:14:21:13 - 00:14:25:12 Multiple cores, each equipped with its own core memory protection unit 00:14:25:12 - 00:14:28:11 and 64 DMA channels between the cores. 00:14:28:11 - 00:14:34:00 In between the cores, DMA channels, and memories is the system memory protection unit. 00:14:34:02 - 00:14:47:00 Knowing in advance that many different applications would be running on the cores, each with its own safety and security levels, Placidity set out to meticulously define the CPU and SMP configurations. 00:14:47:11 - 00:14:53:17 The core CPU and its limitations. Each of the core MPAs monitors all instruction 00:14:53:17 - 00:15:06:06 fetches and data memory accesses originating from each of the cores. The CPU is a hardware facility that system software uses to define memory regions and their associated access permissions. 00:15:06:08 - 00:15:19:23 The CPU triggers an exception if software attempts to access a memory region in violation of its permissions, allowing the system designer to intervene and handle the exception as appropriate. Security wise, the 00:15:19:23 - 00:15:25:06 is a very important part of the overall security posture because of two main points. 00:15:25:06 - 00:15:30:06 one. The CPU is the only entity in a microprocessor architecture. 00:15:30:06 - 00:15:55:07 capable of detecting stack buffer overflows. A stack buffer overflow occurs when a program writes more data to a buffer located on the stack than the buffer can hold, leading to the overflow of adjacent memory addresses. This can happen when input data is not properly validated or bounded by the program, allowing an attacker to overwrite the return address of a function or other important data on the stack. 00:15:55:09 - 00:16:18:14 As a result, the attacker can potentially execute malicious code on the stack and disrupt the program's normal behavior, eventually gaining arbitrary code execution by carefully defining stack areas for all applications running on the microcontroller. The designer can configure the CPU to block execution on those stack areas, thus considerably limiting the attack surface. 00:16:18:14 - 00:16:24:00 Two the CPU effectively limits applications. Read and write operations. 00:16:24:06 - 00:16:50:15 This makes certain that if an attacker gains code execution on any of the cores. For example, by running from a malicious third party code, a properly configured CPU is there to detect a malicious memory access and disrupt the attacker's move. Or does it? Looking back, we can see that although having a properly configured CPU on each of the cores does help prevent memory accesses from the cores themselves. 00:16:50:17 - 00:17:25:12 It does nothing to prevent an attacker on the cores from accessing memories by exploiting special peripherals such as direct memory access, Ethernet, HSM, and more. To effectively defend against these types of attacks. We have the SMP you the system MPU. On first glance, the SMP you is very similar to the CPU. It is a hardware facility that system software uses to define memory regions and their associated access permissions, and upon violation of its permissions, allows the system designer to intervene and handle an exception thrown. 00:17:25:14 - 00:17:36:21 However, the SMP U has one special feature that the CPU does not have. The SMP you concurrently monitors and evaluates memory accesses per bus master. 00:17:36:21 - 00:17:40:05 Each bus master has its own read write and none flags. 00:17:40:05 - 00:17:53:21 that manage its access to a specified memory region. For example, the SMP, you may be set up such that a specific memory region may be accessed by the HSM only, while all other masters are to be rejected. 00:17:53:23 - 00:18:15:20 In that case, although the CPU does not block access to those specific HSM addresses, any attempt to read or write to HSM memory would be effectively blocked by the SMP. You. Another example is DMA access. An application running on core 1st May be specifically blocked from accessing a memory region by Core One's CPU. 00:18:15:20 - 00:18:20:13 However, an attacker may use the DMA hardware to gain read and write access. 00:18:20:13 - 00:18:25:17 to that forbidden memory region, and by doing that, circumvent the CPU prohibition. 00:18:25:19 - 00:18:53:04 It seems, therefore, that one of the SMP crucial features is its ability to block memory access by the originating master. And as a consequence, to block other masters from accessing the memory. To summarize, in the microcontroller architecture, core MPAs play a critical role in monitoring and regulating memory accesses from each core. They enforce memory regions and their permissions, triggering exceptions when violations occur. 00:18:53:06 - 00:19:25:15 This capability is pivotal for security, for example, in preventing stack buffer overflows, a common attack vector, from becoming arbitrary code executions. While campus address core based memory accesses, they don't cover attacks exploiting special peripherals like direct memory access. This gap is filled by the System Memory Protection Unit, which extends protection to various bus masters. SMP use can concurrently monitor and evaluate memory accesses per master, enabling granular control over memory permissions. 00:19:25:16 - 00:19:56:23 In essence, the SMP use unique capability to regulate access by the originating masters enhances overall system security, thwarting potential exploits leveraging peripheral hardware. Configuring the SMP you. In the previous section, we learned of the importance of properly configuring both the CPU to prevent application code running on the cores from directly accessing forbidden memory areas due to security or safety reasons, and the SMP you to prevent indirect memory access. 00:19:57:01 - 00:20:02:07 The SPC 58 end chip that we were using had 24 region registers 00:20:02:07 - 00:20:06:17 That allowed the designer to set, read, and write access control permissions. 00:20:06:17 - 00:20:22:09 per each of the 16 bus masters. Each SMP region is composed of a 32 bit start address and an end address, which is the protected address area and region format registers. These defined for the 16 bus masters. 00:20:22:11 - 00:20:24:05 The allowed access permissions 00:20:24:11 - 00:20:25:02 Read, 00:20:25:09 - 00:20:26:05 read and write 00:20:26:08 - 00:20:27:19 or no access allowed. 00:20:28:03 - 00:20:30:04 ownEach region has its own valid bid 00:20:30:04 - 00:20:31:15 And a read only bed. 00:20:31:15 - 00:20:38:16 But before delving into the read only bid in the next section, let's first address another important SNP register or 00:20:38:16 - 00:20:40:18 The control and error status register. 00:20:40:18 - 00:20:43:04 Once everything is properly configured, 00:20:43:04 - 00:20:46:23 The global valid bit in the control and error status register zero. 00:20:46:23 - 00:20:52:16 has to be set and the SMP you is enabled and ready to counter any potential attack. 00:20:52:17 - 00:21:27:13 The read only or R0 bit serves the purpose of preventing unintended alterations to the region descriptor. When the R0 bit is set writes to any location in the region, registers are ignored. That's perfectly understandable and important. We want the region to be protected from accidental or malicious rights once it is set. Note that once the R0 bit is set, all the region is locked and cannot be changed until the system reset at which time the region valid bid and the global valid bid has no effect, meaning they cannot be changed until the system reset. 00:21:27:15 - 00:21:48:18 Here is a smart defensive trick. Once the SMP region information is configured and the R0 bits are set, the global valid bit cannot be manipulated and therefore an attacker would not be able to disable the SMP. You. The only way to disable the SNP you would be after the next system reset, so the attacker would lose any grip they had on the device under attack. 00:21:48:20 - 00:22:12:12 The SMP you vulnerability. After we finished setting up the SNP view, we can now start testing the entire system. The product was configured such that one core was running the safety application, and the second core was running third party applications. Naturally, the two cores shared memories. The SMP was configured to protect the memory area of the safety application like flash, EEProm 00:22:12:12 - 00:22:13:15 And Ram. 00:22:13:15 - 00:22:16:15 against reads and writes from the application core. 00:22:16:17 - 00:22:21:20 Furthermore, the probe bits were all set so it wouldn't allow any changes 00:22:21:20 - 00:22:23:23 To the SMP you protections. 00:22:23:23 - 00:22:25:17 until the system reset 00:22:25:17 - 00:22:32:00 During penetration testing, we simulated an attacker on the application core. We soon found out that. 00:22:32:00 - 00:22:58:03 although the data sheet of the SPC 58 specifically mandated that the global valid bit would have no effect on the SMP you after setting the R0 bits, this hardware mechanism was not implemented in the silicon, and therefore an attacker on the application core would be able to disable the SMP you by writing zero to the global valid bit, and then gain access to the memories of the safety core for both read and write operations. 00:22:58:05 - 00:23:33:04 Even if the CPU would have been correctly configured disabling the SMP, you would have opened the main memories to attacks through system peripherals such as the DMA or Ethernet. Disclosure to STMicroelectronics. Right after finding about this behavior on the SPC 58 chip, Plex contacted STMicroelectronics CERT with all relevant information about the weakness. After some back and forth correspondence, St microelectronics said they would release an Arata for the issue and here is their full response to the issue. 00:23:33:06 - 00:24:00:12 Quote the behavior deviation of SMP. You you detected may affect Non-Secure device domains. However, this domain should not be used for storing security information. Secret slash security critical data shall be stored within the HSM subsystem memory. If stored outside, they need to be encrypted. The SM Pu is not a security protection mechanism, rather, for example, it helps to avoid interference, unquote. 00:24:00:14 - 00:24:33:08 Since this PowerPC architecture was developed as a part of a joint venture between STMicroelectronics and NXP, it was only natural to continue our quest and look for the same weakness in the NXP PowerPC chips. Placidity X chose the NSP, MPC 5748, which is described as an ultra reliable MCU for automotive and industrial control and gateway. To see if this power PC holds a better security posture than the St microelectronics PowerPC chip. 00:24:33:08 - 00:24:38:10 Just looking. We could not help but wonder where the core memory protection units are. 00:24:38:10 - 00:24:46:03 None of them is protected by a CPU. It seems that this system on chip only has a system memory protection unit. 00:24:46:03 - 00:24:50:23 Further investigating, we found that the MPC 5748 SMP you. 00:24:50:23 - 00:24:54:06 also contains the functional ity of the CPU. 00:24:54:08 - 00:25:22:09 This means that if the same weakness that was found in the PC 58 exists in the MPC 5748, an attacker would be able to completely disable the entire memory protection system. Core and system protections included. Quite similar to the STMicroelectronics SPC 58, a region descriptor lock or read only bit in the SPC 58 is used to lock the memory protected regions after these have been configured. 00:25:22:11 - 00:25:29:19 Once you lock the regions, the global valid bit of the SNP has no effect. So the SMP you cannot be disabled anymore. 00:25:29:19 - 00:25:49:00 A short test revealed that although the SM Pu is enabled in all region script descriptor lock bits are locked, a privileged attacker can still set the global value to zero. And by doing that, completely disable the SMP you. Since there is no separate CPU by disabling the SMP, you, an attacker gains unrestricted 00:25:49:00 - 00:25:51:12 Read, write and execute access. 00:25:51:12 - 00:25:53:10 to the entire memory space. 00:25:53:12 - 00:26:02:18 Disclosure to NXP right after finding out about this behavior on the MPC 5748 chip Placidity X contacted NXP 00:26:02:18 - 00:26:26:13 heard with all relevant information about the weakness. After some back and forth correspondence and NXP acknowledged the documentation was not clear and said they would release a documentation errata this summer to remove ambiguity and prevent misunderstanding. However, NXP stated that the SMP U is not a security feature and Nxp's full response quote. 00:26:26:15 - 00:26:51:21 The products reference manual is clear about the SMP you not being a security feature. The SMP you is not mentioned in the chapter Security Overview, nor in the section Security Modules, but rather in the section on System modules. The SMP U is also not listed under security in the feature list table, and the chapter that describes the SMP you does not mention security, unquote. 00:26:51:21 - 00:26:56:21 As much as we read through the reference manual of the MPC 5748 chip. 00:26:56:21 - 00:27:01:14 We could not find a positive reference to the SNP not being a security mechanism. 00:27:01:14 - 00:27:15:03 To the contrary, in chapter 21, section two of the reference manual. The SMP paragraph states that the System Memory Protection Unit, SMP U provides hardware access control for system bus memory. 00:27:15:03 - 00:27:42:00 References. The SMP you can currently monitors system bus transactions and evaluates their appropriateness using Preprogram region descriptors that define memory spaces and their access rights. Memory references that have sufficient access control rights are allowed to complete, while references that are not mapped to any region descriptor or have insufficient rights are terminated with an access error response, unquote. 00:27:42:10 - 00:28:02:15 So although the reference manual does not mention the SMP, you direct or indirect other than in the SMP chapter, the reference manuals author described the SMP you as being in charge of controlling access permissions to the memory spaces of the MCU, which is the cornerstone of computer security. 00:28:03:14 - 00:28:04:15 Mitigations. 00:28:05:08 - 00:28:30:22 Make sure you verify all important claims, especially those that involve important security mechanisms, such as MPAs made in the data sheet, either by testing them yourself or by going to an external penetration testing vendor. Always read your MCUs errata as they may contain important information about the chip security posture relating to CVA 2020 3-48010. 00:28:31:00 - 00:28:52:23 If you find that you cannot rely on a hardware mechanism for security, as in the case of the SMP, you above don't look for other methods to achieve the same level of security, or make sure you use it in a safe and secure way. For instance, use other memory protection units such as the CMP CPU in the St microelectronics MCU. 00:28:53:17 - 00:29:25:01 Concluding remarks. As shown throughout this episode, memory protection units are a crucial part of every microcontrollers defense strategy. MPAs are indispensable in the context of automotive applications by enhancing the security, reliability, and safety of ECUs and embedded systems within vehicles. It is therefore extremely difficult for us to accept NXP and STMicroelectronics argument that a hardware mechanism designed to enforce access controls over shared resources is not a security mechanism. 00:29:25:03 - 00:29:30:02 Although both vendors specifically mentioned that when following a sequence of operations, 00:29:30:02 - 00:29:46:22 The SNP, you can no longer be deactivated. We showed that the hardware parts that were supposed to lock the global valid bit were not implemented. Therefore, allowing a privileged attacker to disable the SMP you and gain access to sensitive memory regions that were otherwise inaccessible. 00:29:48:13 - 00:29:54:11 That's all for today's episode. Keep your engines running smooth and your cyber defense is sharp. 00:29:54:11 - 00:29:58:23 Stay connected by subscribing and visiting placidity. X-Com. 00:29:59:00 - 00:30:03:00 Until next time, stay safe on the road and in the cloud.