DMA Device Enabled Too Early in Boot Phase

This vulnerability occurs when a device with Direct Memory Access (DMA) capability is activated before the system's security settings are fully locked in during the boot process. This oversight can let an attacker bypass normal protections to read sensitive data from memory or escalate their privileges on the system.

DMA allows hardware devices to transfer data directly to and from the system's main memory, bypassing the operating system for speed. While useful for performance, this creates a major security risk if an untrusted device is granted this powerful access before security measures like Input-Output Memory Management Units (IOMMUs) or similar virtualization-based protections are enabled. An attacker with physical or compromised peripheral access could exploit this early window to launch a DMA attack and steal secrets like encryption keys or passwords. This issue is particularly relevant for 'early boot' IPs—hardware components that are powered up and initialized before the boot sequence finishes. If these components have DMA capability and are not considered trusted, they become a potent attack vector. To prevent this, system designers must ensure that all DMA-capable devices are either inherently trusted or that their DMA functionality remains disabled until after the core security configuration and isolation policies are fully established during boot.