Breaking SMM with a 1-Second Instruction

Exploiting System Management Mode with a very long interrupt

A new proof-of-concept shows how a single, absurdly long machine instruction can desynchronize the System Management Mode (SMM) rendezvous on x86 CPUs, allowing one core to run outside SMM while others are trapped inside. The technique exploits a slow MMIO read that stalls for over a second, bypassing the one-second timeout that normally forces all cores into SMM. This opens the door to exploiting hundreds of dormant SMM TOCTOU vulnerabilities from software alone, without physical access or malicious hardware.