ReVault! Compromised by your Secure SoC

ReVault! Compromised by your Secure SoC

Speakers: Philippe Laulheret

Conference: DEF CON 33

YouTube: https://www.youtube.com/watch?v=SRALfyEspms

Slides: https://media.defcon.org/DEF%20CON%2033/DEF%20CON%2033%20presentations/Philippe%20Laulheret%20-%20ReVault%21%20Compromised%20by%20your%20Secure%20SoC%20-%20Presentation.pdf

Overview

Philippe Laulheret, a senior vulnerability researcher at Cisco Talos, presents a comprehensive attack chain against Dell's ControlVault 3 — a dedicated security System-on-Chip (SoC) found in over 100 models of Dell Latitude and Precision business laptops. The talk details multiple vulnerabilities discovered in both Dell and Broadcom components that, when chained together, result in a full compromise of a device explicitly designed to be the trusted root of security for biometric authentication, smart card access, and credential storage. The research demonstrates that a component positioned as the security anchor of an enterprise laptop can itself become the attack surface.

Background

▶ Watch: You have Windows API, Linux API. (2:16)

ControlVault is Dell's implementation of a dedicated security subsystem for its business laptop lines. It sits on a separate physical board inside the laptop chassis — Laulheret shows a photo of the board covered in tape, with a small flash module attached — and aggregates input from the fingerprint reader, NFC card reader, and smart card reader. In the Windows Device Manager it appears as an obscure entry that most users and even many administrators would not recognize.

The security model is straightforward in principle: sensitive biometric and credential operations happen on an isolated processor, not on the main CPU where the OS and applications run. Even if Windows is compromised, the theory is that the attacker cannot reach the credentials stored in ControlVault. This isolation is the core security promise.

The hardware is built on a Broadcom chip. The firmware running on it — the ControlVault firmware — is developed and maintained by Dell. This creates a dual attack surface: vulnerabilities can exist in the Broadcom hardware/firmware layer, in Dell's firmware layer, or in the communication interfaces between them and the host system.

Key Findings

▶ Watch: Uh D is a bit of a question mark. (13:28)

Multiple distinct vulnerabilities across the stack. The research identified a chain of bugs spanning Dell's ControlVault firmware and Broadcom's underlying components. No single bug provides full compromise; the attack requires chaining them together.

Heap overflow in Dell firmware. A heap overflow vulnerability exists in the Dell-written firmware component. This is the primary exploitation primitive. Laulheret provides detailed analysis of the heap layout, how the overflow is triggered, and how it can be leveraged to achieve code execution within the ControlVault firmware context.

The trust boundary is the target. The whole point of attacking ControlVault is to subvert the trust boundary it establishes. If an attacker achieves code execution inside ControlVault, they are operating within the trusted enclave — able to access stored credentials, biometric templates, and smart card secrets that are supposed to be isolated from a compromised host OS. The attack turns the security component into the attacker's foothold.

Privilege escalation across isolation boundaries. The chain involves not just the overflow but also techniques for navigating the privilege separation within the SoC itself, escalating from an initial code execution primitive to full control of the secure environment.

Responsible disclosure with Dell and Broadcom. Laulheret reported the findings to both Dell and Broadcom through coordinated disclosure at the beginning of the year. The talk is presented after fixes have been developed and deployed, and CVEs have been assigned. The timeline from report to patching and public disclosure is discussed, along with the coordination challenges of involving multiple vendors.

Technical Deep Dive

▶ Watch: epic exploitation that's that's me when I have to learn you know a new heap... (21:58)

ControlVault architecture. The SoC runs a real-time operating system (RTOS) and communicates with the host Windows system through a USB-based protocol. The host driver sends commands to ControlVault, which processes them and returns results. The communication surface — commands, their parameters, and the parsing logic — constitutes a significant portion of the attack surface.

Heap overflow mechanics. Laulheret walks through how the heap is structured in the ControlVault firmware. The vulnerable parsing code fails to validate the size of an attacker-controlled input before copying it into a heap allocation. By sending a crafted command from the host, an attacker can overflow into adjacent heap chunks.

Exploitation strategy. Because the heap layout in a small embedded RTOS is often more deterministic than a full OS, heap grooming is more tractable. Laulheret demonstrates how to position a target object — one that, when corrupted, gives the attacker control over execution — adjacent to the overflow source. The technique is adapted from general heap exploitation but requires specific knowledge of the RTOS memory allocator.

Function pointer overwrite. The exploitation chain uses the overflow to corrupt a function pointer or vtable-like structure within the RTOS, redirecting execution to attacker-controlled code when the corrupted object is subsequently used. This is the stage where code execution is achieved within the ControlVault context.

Broadcom component vulnerabilities. The presentation also covers vulnerabilities in the Broadcom firmware layer beneath Dell's code. These are distinct from the heap overflow and involve different classes of bugs. The interaction between the Dell and Broadcom layers — and the trust relationship between them — is part of the attack chain, as controlling one layer can potentially leverage trust granted by the other.

Flash access and persistence. Because ControlVault has its own flash storage, code execution within it opens the possibility of persistent implantation — writing modified firmware that survives a host OS reinstall or even a BIOS update, since the ControlVault firmware update path is separate from the main BIOS.

Debug interface exposure. Laulheret discusses the role of debug interfaces in the research process. The small flash module visible on the ControlVault board is a JTAG or SPI flash that allowed the team to read and modify firmware for analysis, enabling the deep understanding of the heap layout necessary for reliable exploitation.

Demo / Proof of Concept

▶ Watch: Uh I'm just uh going to run the the attack to leak the keys as I've described. (26:22)

The talk includes a demonstration of the vulnerability chain in action against a real Dell Latitude laptop. The demo shows the attack being triggered from the host — sending crafted commands through the ControlVault USB interface — and achieving code execution within the ControlVault firmware. The audience can observe that this happens from a context that would normally be considered untrusted (the host OS), breaching the isolation boundary that ControlVault is specifically designed to enforce.

Laulheret also demonstrates the post-exploitation capabilities available once ControlVault is compromised: access to stored credential material that would normally be inaccessible even to a root-level compromise of the host OS.

Defensive Implications

▶ Watch: I modified the silver figure with the identify function. (32:37)

Apply Dell and Broadcom patches immediately. Both vendors have released firmware updates addressing the reported vulnerabilities. Enterprise administrators with fleets of affected Dell Latitude and Precision laptops should treat ControlVault firmware updates with the same urgency as BIOS updates — perhaps higher, given the trust level the component holds.

Audit your firmware update pipelines. ControlVault firmware is updated separately from the main BIOS and Windows Update. Many organizations have mature patch pipelines for OS and applications but have blind spots for embedded component firmware. This research illustrates why those blind spots matter.

Reconsider implicit trust in hardware security components. The security architecture of many enterprise deployments assumes hardware security subsystems (TPMs, secure enclaves, dedicated security SoCs) are trustworthy by definition. This research demonstrates that these components have their own attack surfaces and should be subject to the same security scrutiny as any other software-bearing component.

Physical access is not required. The attack is triggered via software from the host OS — no physical access to the ControlVault board or its debug interfaces is needed for exploitation, only for research. This means the attack is in scope for any threat model that includes a compromised host OS.

Monitor for unusual ControlVault communication patterns. Endpoint detection solutions that can observe USB host controller traffic may be positioned to detect anomalous command patterns sent to ControlVault, though this is a high-fidelity detection requirement that most current EDR tools do not implement.

Key Takeaways

1. Dell ControlVault 3, present in over 100 business laptop models, contains a chain of vulnerabilities that allow full compromise of the secure SoC from the host OS.
2. A heap overflow in Dell's ControlVault firmware is the primary exploitation primitive, enabling code execution within the secure enclave context.
3. Compromising ControlVault subverts the fundamental isolation between the host system and stored credentials, biometric templates, and smart card secrets.
4. The attack does not require physical access — it is exploitable from a compromised or malicious host OS context.
5. Both Dell and Broadcom patches are available; enterprise environments should prioritize deploying them.
6. Hardware security components that define trust boundaries are high-value targets precisely because of the trust they hold, and they must be subjected to rigorous security research.

About the Speaker(s)

▶ Watch: I don't know how that works but but the parent stack frame doesn (38:45)

Philippe Laulheret is a Senior Vulnerability Researcher at Cisco Talos, where he focuses on Windows security, embedded systems, and vulnerability research in third-party software. His work follows a coordinated disclosure model: vulnerabilities are reported to vendors, tracked through remediation, and published after fixes are available. His research spans from OS-level Windows vulnerabilities to the kind of deep embedded firmware analysis demonstrated in this talk.