Kernel DMA Protection
Kernel DMA Protection is a Windows security feature that protects against external peripherals from gaining unauthorized access to memory.
PCIe hot plug devices such as Thunderbolt, USB4, and CFexpress allow users to attach classes of external peripherals, including graphics cards, to their devices with the plug-and-play ease of USB.
These devices are DMA-capable, and can access system memory and perform read and write operations without the need for the system processor’s involvement. This capability is the reason behind the exceptional performance of PCI devices, but it also makes them susceptible to drive-by DMA attacks.
Drive-by DMA attacks are attacks that occur while the owner of the system isn’t present and usually take just a few minutes, with simple-to-moderate attacking tools (affordable, off-the-shelf hardware and software), that don’t require the disassembly of the device. For example, attackers can plug in a USB-like device while the device owner is on a break, and walk away with all the secrets on the machine, or inject a malware that allows them to have full control over the device remotely while bypassing the lock screen.
Kernel DMA Protection feature doesn’t protect against DMA attacks via 1394/FireWire, PCMCIA, CardBus, or ExpressCard.
How Windows protects against DMA drive-by attacks
Windows uses the system Input/Output Memory Management Unit (IOMMU) to block external peripherals from starting and performing DMA, unless the drivers for these peripherals support memory isolation (such as DMA-remapping). Peripherals with DMA Remapping compatible drivers will be automatically enumerated, started, and allowed to perform DMA to their assigned memory regions.
By default, peripherals with DMA Remapping incompatible drivers will be blocked from starting and performing DMA until an authorized user signs into the system or unlocks the screen. IT administrators can modify the default behavior applied to devices with DMA Remapping incompatible drivers using MDM or group policies.
User experience
When Kernel DMA Protection is enabled:
- Peripherals with DMA Remapping-compatible device drivers will be automatically enumerated and started
- Peripherals with DMA Remapping-incompatible drivers will be blocked from starting if the peripheral was plugged in before an authorized user logs in, or while the screen is locked. Once the system is unlocked, the peripheral driver will be started by the OS, and the peripheral will continue to function normally until the system is rebooted, or the peripheral is unplugged. The peripheral will continue to function normally if the user locks the screen or signs out of the system.
Windows edition and licensing requirements
The following table lists the Windows editions that support Kernel Direct Memory Access (DMA) protection:
| Windows Pro | Windows Enterprise | Windows Pro Education/SE | Windows Education |
|---|---|---|---|
| Yes | Yes | Yes | Yes |
Kernel Direct Memory Access (DMA) protection license entitlements are granted by the following licenses:
| Windows Pro/Pro Education/SE | Windows Enterprise E3 | Windows Enterprise E5 | Windows Education A3 | Windows Education A5 |
|---|---|---|---|---|
| Yes | Yes | Yes | Yes | Yes |
For more information about Windows licensing, see Windows licensing overview.
System compatibility
Kernel DMA Protection requires UEFI firmware support, and Virtualization-based Security (VBS) isn’t required.
Kernel DMA Protection isn’t compatible with other BitLocker DMA attacks countermeasures. It’s recommended to disable the BitLocker DMA attacks countermeasures if the system supports Kernel DMA Protection. Kernel DMA Protection provides higher security bar for the system over the BitLocker DMA attack countermeasures, while maintaining usability of external peripherals.
DMA remapping support for graphics devices was added in Windows 11 with the WDDM 3.0 driver model; Windows 10 doesn’t support this feature.
Check if Kernel DMA Protection is enabled
Systems that support Kernel DMA Protection will enable the feature automatically, with no user or IT admin configuration required.
You can use the Windows Security settings to check if Kernel DMA Protection is enabled:
- Open Windows Security.
- Select Device security > Core isolation details > Memory access protection
Alternatively, you can use the System Information desktop app ( msinfo32.exe ). If the system supports Kernel DMA Protection, the Kernel DMA Protection value will be set to ON. 
If the current state of Kernel DMA Protection is OFF and Hyper-V — Virtualization Enabled in Firmware is NO:
- Reboot into UEFI settings
- Turn on Intel Virtualization Technology
- Turn on Intel Virtualization Technology for I/O (VT-d)
- Reboot system into Windows
If the Hyper-V Windows feature is enabled, all the Hyper-V-related features will be hidden, and A hypervisor has been detected. Features required for Hyper-V will not be displayed entity will be shown at the bottom of the list. It means that Hyper-V — Virtualization Enabled in Firmware is set to YES.
Enabling Hyper-V virtualization in Firmware (IOMMU) is required to enable Kernel DMA Protection, even when the firmware has the flag of ACPI Kernel DMA Protection Indicators described in Kernel DMA Protection (Memory Access Protection) for OEMs.
If the state of Kernel DMA Protection remains Off, then the system doesn’t support Kernel DMA Protection.
For systems that don’t support Kernel DMA Protection, refer to the BitLocker countermeasures or Thunderbolt 3 and Security on Microsoft Windows Operating system for other means of DMA protection.
Frequently asked questions
Does Kernel DMA Protection prevent drive-by DMA attacks during Boot?
No, Kernel DMA Protection only protects against drive-by DMA attacks after the OS is loaded. It’s the responsibility of the system firmware/BIOS to protect against attacks via the Thunderbolt 3 ports during boot.
How can I check if a certain driver supports DMA-remapping?
Not all devices and drivers support DMA-remapping. To check if a specific driver is opted into DMA-remapping, check the values corresponding to the DMA Remapping Policy property in the Details tab of a device in Device Manager*. A value of 0 or 1 means that the device driver doesn’t support DMA-remapping. A value of 2 means that the device driver supports DMA-remapping. If the property isn’t available, then the device driver doesn’t support DMA-remapping. Check the driver instance for the device you’re testing. Some drivers may have varying values depending on the location of the device (internal vs. external).
When the drivers for PCI or Thunderbolt 3 peripherals don’t support DMA-remapping?
Use the Windows-provided drivers for the peripherals, when available. If there are no class drivers provided by Windows for your peripherals, contact your peripheral vendor/driver vendor to update the driver to support DMA Remapping.
My system’s Kernel DMA Protection is off. Can DMA-remapping for a specific device be turned on?
Yes. DMA remapping for a specific device can be turned on independent from Kernel DMA Protection. For example, if the driver opts in and VT-d (Virtualization Technology for Directed I/O) is turned on, then DMA remapping will be enabled for the devices driver even if Kernel DMA Protection is turned off.
Kernel DMA Protection is a policy that allows or blocks devices to perform DMA, based on their remapping state and capabilities.
Do Microsoft drivers support DMA-remapping?
The Microsoft inbox drivers for USB XHCI (3.x) Controllers, Storage AHCI/SATA Controllers, and Storage NVMe Controllers support DMA Remapping.
Do drivers for non-PCI devices need to be compatible with DMA-remapping?
No. Devices for non-PCI peripherals, such as USB devices, don’t perform DMA, thus no need for the driver to be compatible with DMA Remapping.
How can an enterprise enable the External device enumeration policy?
The External device enumeration policy controls whether to enumerate external peripherals that aren’t compatible with DMA-remapping. Peripherals that are compatible with DMA-remapping are always enumerated. Peripherals that aren’t, can be blocked, allowed, or allowed only after the user signs in (default).
The policy can be enabled by using:
- Group Policy: Administrative Templates\System\Kernel DMA Protection\Enumeration policy for external devices incompatible with Kernel DMA Protection
- Mobile Device Management (MDM): DmaGuard policies
virtualbox.org
Kernel module not loaded?? Can’t start virtualbox
Discussions related to using VirtualBox on Windows hosts.
8 posts • Page 1 of 1
davidm71 Posts: 6 Joined: 9. Jul 2012, 13:57
Kernel module not loaded?? Can’t start virtualbox
Post by davidm71 » 6. Nov 2021, 16:31
Have a Lenovo Thinkpad X1 Carbon Gen 9 trying to get Virtualbox working on after purchasing a new laptop. Installed Virtualbox and couldn’t get off the ground to load the iso installer for ubuntu. Searched here and found recommendation to install latest development branch ver 6.1.29-148084. Installed it with admin privileges. Cant figure this out. Best guess the laptop bios is blocking kernel drivers but its just a guess and I’m no expert.
Here are some screenshots:
Attachments vboxerr2.jpg (81.3 KiB) Viewed 2645 times vboxerr1.jpg (75.55 KiB) Viewed 2645 times
scottgus1 Site Moderator Posts: 20361 Joined: 30. Dec 2009, 20:14 Primary OS: MS Windows 10 VBox Version: PUEL Guest OSses: Windows, Linux
Re: Kernel module not loaded?? Can’t start virtualbox
Post by scottgus1 » 6. Nov 2021, 19:50
The vboxdrv query says the service is stopped, which is probably not right. Host security software may be involved. Please zip and post that hardening log using Upload Attachment.
davidm71 Posts: 6 Joined: 9. Jul 2012, 13:57
Re: Kernel module not loaded?? Can’t start virtualbox
Post by davidm71 » 6. Nov 2021, 21:56
Ok here it is.
Attachments VBoxHardening.zip (3.49 KiB) Downloaded 3 times
davidm71 Posts: 6 Joined: 9. Jul 2012, 13:57
Re: Kernel module not loaded?? Can’t start virtualbox
Post by davidm71 » 6. Nov 2021, 23:09
Also getting this:
C:\Windows\system32>sc.exe start vboxdrv
[SC] StartService FAILED 87:
The parameter is incorrect.
davidm71 Posts: 6 Joined: 9. Jul 2012, 13:57
Re: Kernel module not loaded?? Can’t start virtualbox
Post by davidm71 » 7. Nov 2021, 04:07
Well I finally figured it out and got it working. What it came down to was Kernel DMA Protection interfering with the vboxdrv driver loading. Had to go into Windows settings and turn off memory protection. Tried turning off kernel DMA Protection in bios but Windows MSinfo still reported that it was on. In anycase after turning off Memory Protection tried loading the vboxdrv from the lastest development build and that gave an Failure error 577. Tried an older Vboxdrv version and that worked. Read people had luck with 6.1.26 and installed that build and that worked. I also disabled everything HyperV right from the begging. Think the issue is that the lenovo X1 Carbon gen 9 doesn’t turn off DMA protection like the bios is suppose to!
scottgus1 Site Moderator Posts: 20361 Joined: 30. Dec 2009, 20:14 Primary OS: MS Windows 10 VBox Version: PUEL Guest OSses: Windows, Linux
Re: Kernel module not loaded?? Can’t start virtualbox
Post by scottgus1 » 7. Nov 2021, 15:22
Thanks for letting us know how you fixed this, David! I was puzzled about it myself.
FWIW if Hyper-V was involved, I have a 64bit host, but can’t install 64bit guests, 2nd post, points 2 & 3, and the final post have a list of things we know of that might interfere with Virtualbox. The devs are getting closer to full compatibility with active Hyper-V.
Here’s a MS link on Kernel DMA Protection https://docs.microsoft.com/en-us/window . hunderbolt. Maybe you don’t need it.
davidm71 Posts: 6 Joined: 9. Jul 2012, 13:57
Re: Kernel module not loaded?? Can’t start virtualbox
Post by davidm71 » 7. Nov 2021, 15:28
Thanks but disabling HyperV was first thing I tried. Turned out to be the DMA execution protection.
Going to report to Lenovo that their bios level switch for it doesnt work.
Had to disable it in Windows Security settings.
Might have already read that document.
If only way to whitelist the vboxdrv driver would be great.
Also seems like the development builds dont gave their drivers signed.
Also caused an issue.
scottgus1 Site Moderator Posts: 20361 Joined: 30. Dec 2009, 20:14 Primary OS: MS Windows 10 VBox Version: PUEL Guest OSses: Windows, Linux
Re: Kernel module not loaded?? Can’t start virtualbox
Post by scottgus1 » 7. Nov 2021, 15:31
davidm71 wrote: the development builds dont gave their drivers signed.
True. It would take too long for reasonably-timed feedback on the quality of the build and development would be too slow if they had to sign the drivers.
How can Legacy Boot be enabled on a 2019 ThinkPad?
I have a 2019 ThinkPad X390 with Windows 10 and want to install Ubuntu. I have always used Legacy Boot previously, not UEFI, and want to see how to have that option. In the UEFI-BIOS, I can see that the option to change UEFI/Legacy Boot from UEFI Only to `Legacy Only’ is not selectable and beside it is written the text
Unselectable for Kernel DMA Protection How can the option to change this be enabled?
17k 9 9 gold badges 46 46 silver badges 77 77 bronze badges
Saved searches
Use saved searches to filter your results more quickly
Cancel Create saved search
You signed in with another tab or window. Reload to refresh your session. You signed out in another tab or window. Reload to refresh your session. You switched accounts on another tab or window. Reload to refresh your session.
ufrisk / pcileech Public
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Cant Turn off Kernel DMA protection for thunderbolt 4 ? #237
viperr86 opened this issue May 14, 2023 · 1 comment
Cant Turn off Kernel DMA protection for thunderbolt 4 ? #237
viperr86 opened this issue May 14, 2023 · 1 comment
Comments
viperr86 commented May 14, 2023
Post before that dma give blue screen and i open up everyting but DMA Kernel Protection is always ON whatever i do?
I choose inactivate Kernel DMA security but still always says that its ON when i check in msinfo.
Its TB4 and cant find any info about it to get the DMA working on this laptop with the OWC encloser and most get that DMA security of somehow? Heard its not possible to use DMA on TB4 now is that the case really?
i see pictures that you have working dma in your laptop, how you do it? can you provide devices names pls
BIOS dont have that features its a Lenovo Legion 5 pro.
Thanks again
The text was updated successfully, but these errors were encountered: