Breaking SMM with a 1-Second Instruction
Exploiting System Management Mode with a very long interrupt
A new proof-of-concept shows how a single, absurdly long machine instruction can desynchronize the System Management Mode (SMM) rendezvous on x86 CPUs, allowing one core to run outside SMM while others are trapped inside. The technique exploits a slow MMIO read that stalls for over a second, bypassing the one-second timeout that normally forces all cores into SMM. This opens the door to exploiting hundreds of dormant SMM TOCTOU vulnerabilities from software alone, without physical access or malicious hardware.
SMM's one promise, that nothing else runs while it does, falls apart in the face of one absurdly long instruction.
- codedokode
Technically this is not a vulnerability because you need to be root. I would rather call it "taking back control of your hardware". SMM is an evil thing because the user cannot control it or look into SMM memory region. Why do CPU vendors implement a mode that cannot be controlled by the user? Obviously to use it in user-hostile purposes (software copying prevention and reporting, DRM, government access backdoors, etc.), I see no other explanation.
- mike_hearn
The designers of the firmware anticipate this attack but punt it to the vendor, apparently:
//
// Platform implementor should choose a timeout value appropriately:
[snip]
// - The timeout value must be longer than longest possible IO operation in the system
- Hyperlisk
Related repo from them, mentioned in the readme as well: https://github.com/xoreaxeaxeax/asm-hall-of-shame
> Instruction latency analysis usually focuses on performance optimization—making code run as fast as possible. The Assembly Hall of Shame takes the opposite approach: searching for the absolute floor of single-instruction performance.
Fun stuff!
- nazgulsenpai
I'm amused at the lengths the readme goes to in order to drive home the fact that this needs to be a LOOOOOOOOOOOOOOOOOOOONG instruction, including the unnecessarily long code block illustration. The topic is interesting anyway, but that makes it way more entertaining.
- hyperhello
SMM calls for a timeout because it wants everything to be between instructions pro forma. So there’s a very long instruction on a core, but after it completes, the core does stop, right? It seems like to make this into an attack you’d have to a very long instruction that also somehow interacts with the thing the SMM is doing, while it’s doing it.