\HeadingLevelB{Privileged Software Attacks}
\label{sec:system_software_attacks}

The rest of this section points to successful exploits that execute at each of the privilege levels described in \S~\ref{sec:rings}, motivating the SGX design decision to assume that all privileged software on the computer is malicious.
\citep{rutkowska2015intelsux} describes all programmable hardware inside Intel computers, and outlines the security implications of compromising the software running it.

SMM, the most privileged execution level, is only used to handle a specific kind of interrupts (\S~\ref{sec:interrupts}), namely \textit{System Management Interrupts} (SMI).
SMIs were initially designed exclusively for hardware use, and were only triggered by asserting a dedicated pin (SMI\#) in the CPU's chip package.
However, in modern systems, system software can generate an SMI by using the LAPIC's IPI mechanism.
This opens up the avenue for SMM-based software exploits.

% System Management Mode: SDM S 34
% SMRAM: SDM S 34.4
% SMRAM Caching: SDM S 34.4.2

The SMM handler is stored in  \textit{System Management RAM} (SMRAM) which, in theory, is not accessible when the processor isn't running in SMM.
However, its protection mechanisms were bypassed multiple times~\citep{duflot2006smm, rutkowska2008remap, wojtczuk2009smm, kallenberg2014smm}, and SMM-based rootkits~\citep{wecherowski2009smm, embleton2010smm} have been demonstrated.
Compromising the SMM grants an attacker access to all software on the computer, as SMM is the most privileged execution mode.

Xen \citep{zhang2008xen} is a very popular representative of the family of hypervisors that run in VMX root mode and use hardware virtualization.
At 150,000 lines of code~\citep{xen2015loc}, Xen's codebase is relatively small, especially when compared to a kernel.
However, Xen still has had over 40 security vulnerabilities patched in \textbf{each} of the last three years (2012-2014) \citep{cvedetails2014xen}.

\citep{mccune2010trustvisor} proposes using a very small hypervisor together with Intel TXT's dynamic root of trust for measurement (DRTM) to implement trusted execution.
\citep{vasudevan2010requirements} argues that a dynamic root of trust mechanism, like Intel TXT, is necessary to ensure a hypervisor's integrity.
Unfortunately, the TXT design requires an implementation complex enough that exploitable security vulnerabilities have creeped in \citep{wojtczuk2009txt2, wojtczuk2011txt}.
Furthermore, any SMM attack can be used to compromise TXT \citep{wojtczuk2009txt}.

The monolithic kernel design leads to many opportunities for security vulnerabilities in kernel code.
Linux is by far the most popular kernel for IaaS cloud environments.
Linux has \emph{17 million} lines of code~\citep{anthony2014linuxsize}, and  has had over 100 security vulnerabilities patched in \textbf{each} of the last three years (2012-2014)~\citep{cvedetails2014linux, chen2011linux}.
