Another Way to Circumvent Intel Trusted Execution Technology

Earlier this year our team has presented an attack against Intel ® TXT that exploited a design problem with SMM mode being over privileged on PC platforms and able to interfere with the SENTER instruction. This time we present a different attack that allows an attacker to trick the SENTER instruction into misconfiguring the VT-d engine, so that it doesnʼt protect the newly loaded MLE. This attack exploits implementation flaws in a so called SINIT module