ThinkPwn: System Management Mode arbitrary code execution

Post by m1el » Tue, Jul 05, 2016, 4:32 PM UTC

loeg wrote: post #45

OneTwoFree wrote: post #40

I thought I have an intermediate level C knowledge, but I have no idea what is happening in the vulnerable line: *(v3 + 0x8)(*(VOID **)v3, &dword_AD002290, CommunicationBuffer + 0x18); As I understand it is (was) an example code from Intel. Example codes should be easy to understand and well documented.

It's C generated by disassembling x86 assembler code. It is not an example code from Intel. The function pointer at `v3 + 0x8` is invoked with arguments: (1) the pointer at `v3 + 0x0`, (2) some fixed pointer, and (3) a pointer into the CommunicationBuffer. E.g. here's more idiomatic C code to represent the same idea: struct Thunk { void *argument; void (fp)(void *, DWORD *, void *); }; struct CommunicationBuffer { ui…

Post by jimrandomh » Tue, Jul 05, 2016, 4:37 PM UTC

ssebastianj wrote: post #27

jkot wrote: post #19

Earlier quoted context omitted.

Maybe author did not want to deal with Lenovo. > Lenovo did not develop the vulnerable SMM code and is still in the process of determining the identity of the original author, it does not know its originally intended purpose.

The author (Dmytro Oleksiuk) tweeted [0]: 'Dear vendors, “give us your 0day vulnerability for free and don’t publish anything” — it’s not a cooperation request'. [0] https://twitter.com/d_olex/status/748806692754714625

Post by devy » Tue, Jul 05, 2016, 4:38 PM UTC

CaptSpify wrote: post #60

fencepost wrote: post #47

Don't just plaster Lenovo with this - they're getting the splatter because Cr4sh has been researching their firmware, but this is a multi-vendor issue. A few important notes from the article and the releaser's blog post: * This is not a Lenovo problem so much as a problem for multiple vendors who used BIOS based on Intel's reference information. The original problem was with source code provided by Intel. The same pr…

Although you are correct, I don't feel it's bad to blame the vendor who was running code that they didn't know the source of, nor the reasoning behind it's existence.

Post by mindslight » Tue, Jul 05, 2016, 4:41 PM UTC

ihsw wrote: post #23

jonwachob91 wrote: post #8

T450S user here. What exactly does this mean for me? I get it's a security issue, but that's about all I understood...

The attack against you would be interdiction, where the NSA (or whomever) would MITM shipping and receiving. What shipping and receiving? Somewhere between where you will receive the package -- be it your home, PO Box, postal office, etc -- and the originating storage facility (ie: warehouse), there is a long list of hands exchanging your product. One of these hands would be an NSA agent's hands. https://en.wikipedia…

Post by teddyc » Tue, Jul 05, 2016, 4:44 PM UTC

esaym wrote: post #20

jkldotio wrote: post #9

What are we up to now? Three preloaded spyware scandals, possible remote execution via the Intel stack and now this vulnerability. That's just what we know about, who knows what else exists. I don't think I can buy another one, which is sad as I think it was a timeless and great design.

I plan on using my quad core T520 for probably another 5+ years. All of their laptops after the T520 series have the full size keyboard with numberpad which off-sets the center of the keyboard, so now your typing is mostly happing on the left side of the keyboard and that causes wrist strain. Having a numberpad is really lame on a laptop. I won't buy one and I know of no one else that likes the numberpad either.. sad…