SECURITY Signal 501
Exploiting System Management Mode with a very long interrupt
Researchers demonstrate that a single excessively long machine instruction can prevent a CPU core from joining System Management Mode, breaking the all-core synchrony that underpins SMM’s security model.
This shows that the hardware isolation guarantee of SMM can be subverted by a timing attack, affecting any firmware or software that relies on SMM for privileged operations. Engineers must reconsider synchronization assumptions in SMM entry code and evaluate whether existing mitigations sufficiently bound instruction execution time.
Written by elseif from the cluster below · every claim links back to a sourceThe three things worth knowing
The attack keeps one core busy with a long MMIO read so it misses the SMM entry rendezvous while another core proceeds into SMM.
The exploit works because the firmware’s SMM synchronization loop aborts after a one-second timeout, allowing a core to stay outside SMM if it does not respond within that window.
A proof-of-concept on a Zen 3 Ryzen 7 5800H uses a wide xmm load from a slow MMIO address to create the required ~1-second instruction.
THE CLUSTER