PMFault: Voltage Fault Injection on Server Platforms Through the PMBus
summary
Demonstrates a remote voltage-fault chain against Supermicro X11 servers by controlling the PMBus (found at address 0x20) via BMC paths: initial proof uses i2c‑tools and a Raspberry Pi with a custom libaspeed driver, then achieves remote control through firmware flashing (AR update) and IPMItool over the KCS/Ethernet link (IPMItool + KCS remote access). In 253 RSA CRT runs the method produces faults in about 77% of runs, 26% exploitable, yields a useful fault every ~9 minutes, and accidentally destroyed two CPUs (one 2.84 V, 1 ms overvoltage). X12 boards are not vulnerable after disclosure.
AI-written summary · about
chapters (27)
- 0:00Introduction
- 0:24Fault injection on Intel platforms
- 1:29SVID bus fault injection
- 2:33PMBus on server motherboards
- 4:20PMBus protocol and commands
- 5:24Scanning I2C bus
- 6:50Lowering CPU voltage
- 7:53CPU stall after voltage change
- 8:58Raspberry Pi attack
- 9:39BMC chip and PMBus
- 10:42BMC remote fault injection
- 11:24Gaining BMC shell access
- 12:50BMC firmware encryption
- 13:52Firmware modification
- 14:38PMBus library for BMC
- 15:19Fault injection results
- 16:03CPU destruction incident
- 18:08IPMI tool for PMBus
- 19:14Simplified attack via IPMI without firmware modification
- 20:16Testing on X11 motherboards
- 21:19Vendor mitigation X12 series
- 21:42Key security takeaways
- 23:30BMC isolation implications
- 24:13Design considerations
- 24:56PMFault detection tool
- 25:17Acknowledgments
- 25:44Q&A
related talks
51mFirmware Cartography: Charting the Course for Modern Server Compromise
28mComplexity Killed Security
54mCLKscrew: Exposing The Perils of Security-Oblivious Energy Management
16mCAUTION: HIGH VOLTAGE, LOW SECURITY – A Familiar Tale of...
29mFrom an URGENT/11 Vulnerability to a Full Take-Down of a Factory, Using a Single Packet
44mSilicon Under Attack Physical Exploitation Of Modern Chips
42mIdentifying Safety Weaknesses and Fault Propagation in the Linux Kernel
44mCritical Zero Days Remotely Compromise the Most Popular Real-Time OS