Exploiting System Management Mode with a very very very very very very very long interrupt.

Overview

It turns out that you can break SMM — the secure, ultra privileged execution environment running invisibly in the background of every x86 CPU — with nothing more than an obscenely long-running machine instruction.

SMM requires that all cores are either in SMM or out of SMM at the same time. Its security model doesn't work without this - when one thread enters SMM, it makes all the others enter too.

To break this, all we need is someone too busy to notice they're supposed to join SMM.

It works something like this:

core 0 - start a long instruction | | | core 1 - invite core 0 to smm | | | core 1 - enter smm | | | core 1 - wait for core 0 | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | core 1 - wait for core 0 | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | core 1 - wait for core 0 | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | |…