Exploiting System Management Mode with a very long interrupt

#1

Post by WhiteDawn » Mon, Aug 10, 2026, 4:03 PM UTC

Exploiting System Management Mode with a very long interrupt
github.com

Re: Exploiting System Management Mode with a very long interrupt

#2

Post by nazgulsenpai » Mon, Aug 10, 2026, 4:45 PM UTC

I'm amused at the lengths the readme goes to in order to drive home the fact that this needs to be a LOOOOOOOOOOOOOOOOOOOONG instruction, including the unnecessarily long code block illustration. The topic is interesting anyway, but that makes it way more entertaining.

Re: Exploiting System Management Mode with a very long interrupt

#3

Post by BadBadJellyBean » Mon, Aug 10, 2026, 4:50 PM UTC

nazgulsenpai wrote: post #2

I'm amused at the lengths the readme goes to in order to drive home the fact that this needs to be a LOOOOOOOOOOOOOOOOOOOONG instruction, including the unnecessarily long code block illustration. The topic is interesting anyway, but that makes it way more entertaining.

Do you think a short instruction is okay or does it need to be long? The instructions were a bit unclear in that regard :D

Re: Exploiting System Management Mode with a very long interrupt

#4

Post by londons_explore » Mon, Aug 10, 2026, 4:52 PM UTC

Unclear why there is a 1 second timeout at all.

Presumably the patch for that will be to make it an infinity timeout.

Re: Exploiting System Management Mode with a very long interrupt

#5

Post by kmeisthax » Mon, Aug 10, 2026, 4:54 PM UTC

...huh, I was wondering why serial machine code prankster xoreaxeaxeax was keeping lists of extremely long-running instructions.

Hopefully this is at least only possible in kernel mode, right?

Right?!

Re: Exploiting System Management Mode with a very long interrupt

#6

Post by xxpor » Mon, Aug 10, 2026, 4:57 PM UTC

londons_explore wrote: post #4

Unclear why there is a 1 second timeout at all. Presumably the patch for that will be to make it an infinity timeout.

Can this be patched? Is there a chance it's a hw watchdog that you can't fix in microcode?

Re: Exploiting System Management Mode with a very long interrupt

#7

Post by xxpor » Mon, Aug 10, 2026, 4:59 PM UTC

kmeisthax wrote: post #5

...huh, I was wondering why serial machine code prankster xoreaxeaxeax was keeping lists of extremely long-running instructions. Hopefully this is at least only possible in kernel mode, right? Right?!

Maybe with vfio/igb_uio/uio_pci_generic? Still root level access.

Re: Exploiting System Management Mode with a very long interrupt

#8

Post by ramses0 » Mon, Aug 10, 2026, 5:08 PM UTC

londons_explore wrote: post #4

Unclear why there is a 1 second timeout at all. Presumably the patch for that will be to make it an infinity timeout.

Looks like it's ~4 billion (2^32) crossover counter?

Re: Exploiting System Management Mode with a very long interrupt

#9

Post by mike_hearn » Mon, Aug 10, 2026, 5:12 PM UTC

The designers of the firmware anticipate this attack but punt it to the vendor, apparently:

    //
    // Platform implementor should choose a timeout value appropriately:
    
    [snip]

    // - The timeout value must be longer than longest possible IO operation in the system

Re: Exploiting System Management Mode with a very long interrupt

#10

Post by Liftyee » Mon, Aug 10, 2026, 5:23 PM UTC

I don't know much about the specifics of CPU architecture apart from the existence of assembly and different modes. Either way the explanation was still entertaining and interesting. smiiiiiiii