Exploiting System Management Mode with a very long interrupt

 (github.com)

36 points | by WhiteDawn 1 hour ago

4 comments

  • mike_hearn 10 minutes ago
    The designers of the firmware anticipate this attack but punt it to the vendor, apparently:

        //
    // Platform implementor should choose a timeout value appropriately:
    
    [snip]

    // - The timeout value must be longer than longest possible IO operation in the system
  • nazgulsenpai 37 minutes ago
    I'm amused at the lengths the readme goes to in order to drive home the fact that this needs to be a LOOOOOOOOOOOOOOOOOOOONG instruction, including the unnecessarily long code block illustration. The topic is interesting anyway, but that makes it way more entertaining.
    [-]
    • BadBadJellyBean 32 minutes ago
      Do you think a short instruction is okay or does it need to be long? The instructions were a bit unclear in that regard :D
  • londons_explore 30 minutes ago
    Unclear why there is a 1 second timeout at all.

    Presumably the patch for that will be to make it an infinity timeout.

    [-]
    • ramses0 15 minutes ago
      Looks like it's ~4 billion (2^32) crossover counter?
    • xxpor 25 minutes ago
      Can this be patched? Is there a chance it's a hw watchdog that you can't fix in microcode?
  • kmeisthax 29 minutes ago
    ...huh, I was wondering why serial machine code prankster xoreaxeaxeax was keeping lists of extremely long-running instructions.

    Hopefully this is at least only possible in kernel mode, right?

    Right?!

    [-]
    • xxpor 23 minutes ago
      Maybe with vfio/igb_uio/uio_pci_generic? Still root level access.