Hacker News new | past | comments | ask | show | jobs | submit

Exploiting System Management Mode with a very long interrupt

https://github.com/xoreaxeaxeax/smiiiiiiiiiiiiiiii
163WhiteDawn | | 58 | HN
mike_hearn | parent | next
The designers of the firmware anticipate this attack but punt it to the vendor, apparently:

    //
    // Platform implementor should choose a timeout value appropriately:
    
    [snip]

    // - The timeout value must be longer than longest possible IO operation in the system
wtallis | parent
I wonder whether a Thunderbolt accessory can cause arbitrarily long IO operations. What's the upper bound before some other layer gives up and causes the instruction to fault?
codedokode | parent | next
Technically this is not a vulnerability because you need to be root. I would rather call it "taking back control of your hardware". SMM is an evil thing because the user cannot control it or look into SMM memory region. Why do CPU vendors implement a mode that cannot be controlled by the user? Obviously to use it in user-hostile purposes (software copying prevention and reporting, DRM, government access backdoors, etc.), I see no other explanation.
loading story #49251955
loading story #49252035
loading story #49252481
loading story #49251607
loading story #49251476
kazinator | parent | next
> Why do CPU vendors implement a mode that cannot be controlled by the user?

Devil's Advocate: can you control every transistor in a good old Z80?

Of course, that's not where the goalposts are. Any piece of hardware will necessarily have limits as to the amount of introspection and manipulation that it allows in the programming model.

What Intel have done is built a "grotto" in the chip that is extraneous and deliberately inaccessible.

loading story #49252885
Hyperlisk | parent | next
Related repo from them, mentioned in the readme as well: https://github.com/xoreaxeaxeax/asm-hall-of-shame

> Instruction latency analysis usually focuses on performance optimization—making code run as fast as possible. The Assembly Hall of Shame takes the opposite approach: searching for the absolute floor of single-instruction performance.

Fun stuff!

nazgulsenpai | parent | next
I'm amused at the lengths the readme goes to in order to drive home the fact that this needs to be a LOOOOOOOOOOOOOOOOOOOONG instruction, including the unnecessarily long code block illustration. The topic is interesting anyway, but that makes it way more entertaining.
BadBadJellyBean | parent
Do you think a short instruction is okay or does it need to be long? The instructions were a bit unclear in that regard :D
loading story #49246897
loading story #49248315
hyperhello | parent | next
SMM calls for a timeout because it wants everything to be between instructions pro forma. So there’s a very long instruction on a core, but after it completes, the core does stop, right? It seems like to make this into an attack you’d have to a very long instruction that also somehow interacts with the thing the SMM is doing, while it’s doing it.
mirashii | parent
If I’ve understood correctly, what your missing here is that the first core in SMM tells the second to join it in SMM, times out on the wait, does its thing and exits, but then the second core joins SMM after the first has exited, so now the first core is running outside SMM, second core in SMM, so first core can attack the second.
cheschire | parent | next
Almost nothing from this GitHub profile posted until the last four days.

From a meta perspective what is going on? What am I missing? Why is this GitHub profile suddenly getting massive attention and making front page so frequently?

loading story #49252891
loading story #49251766
loading story #49251156
ironhaven | parent | next
DEFCON the fun hacking conference in las Vegas that happened last weekend.
_def | parent
This rosenbridge repos commits claim to be 8 years old https://github.com/xoreaxeaxeax/rosenbridge
loading story #49248723
londons_explore | parent | next
Unclear why there is a 1 second timeout at all.

Presumably the patch for that will be to make it an infinity timeout.

loading story #49252330
loading story #49253300
toast0 | parent | next
system management mode does a lot of stuff, some of which is time critical. If your system is overheating and one of the cores is stuck off in the weeds, it's probably better to get on with the thermal response rather than waiting forever.

Also, the System Management Interrupts are supposed to return to normal processing in some finite timespan; a timeout bounds the wait time.

loading story #49249132
loading story #49248581
xxpor | parent | next
Can this be patched? Is there a chance it's a hw watchdog that you can't fix in microcode?
ramses0 | parent
Looks like it's ~4 billion (2^32) crossover counter?
engzaanin | parent | next
The timeout idea is interesting. If firmware can strictly bound SMM execution time, would that actually eliminate this class of attack, or just turn it into a crash/DoS instead?
Liftyee | parent | next
I don't know much about the specifics of CPU architecture apart from the existence of assembly and different modes. Either way the explanation was still entertaining and interesting. smiiiiiiii
PunchyHamster | parent | next
It's nice to see SMM is as terrible idea now as it was at moment of conception.

All coz they can't be arsed to put a tiny management core separate from the rest and save a penny

quotemstr | parent
ARM has EL3, which is basically the same thing. There's nothing inherently wrong with the CPU having multiple privilege levels. The problem with SMM has always been its user-hostile opaque implementation, not that the technical mechanism exists.
kmeisthax | parent | next
...huh, I was wondering why serial machine code prankster xoreaxeaxeax was keeping lists of extremely long-running instructions.

Hopefully this is at least only possible in kernel mode, right?

Right?!

tptacek | parent | next
Is it really a long running instruction? I mean, obviously yes, but what makes it slow is that it's doing an MMIO copy from a slow source. It's like a read(2) system call being "slow" because the fd is associated with a socket to the moon.
loading story #49247033
loading story #49248699
xxpor | parent | next
Maybe with vfio/igb_uio/uio_pci_generic? Still root level access.
codedokode | parent | next
You need to be root.
PunchyHamster | parent
Given that you can connect essentially PCIe devices thru USB it is probably exploitable?

Find out which device is accessible to user and does MMIO, emulate it on FPGA, make it slooooooooow. All it needs to do is for driver to trigger a "right" access". GPU comes to mind

loading story #49251521
quotemstr | parent | next
> The code waits for all cores to enter SMM, or for up to 1 second, whichever occurs first.

See, this is why the mantra that all blocking operations should have a timeout is stupid and short-sighted no matter how many times junior devs and AIs bleat it in code review. Continuing after arbitrary timeouts usually violates invariants, and failing after arbitrary timeouts introduces hard-to-debug failures under load.

Better for the system to hang so you can debug it --- and maybe reboot as a whole via a watchdog --- than for the code to say "Oh, this operation is supposed to be done after one second, but isn't. Situation normal, everything fine. We continue."

No. That situation is very much not fine.

loading story #49253502
| parent
{"deleted":true,"id":49249191,"parent":49249075,"time":1786393457,"type":"comment"}