← Back to articles

Exploiting System Management Mode with a very long interrupt

2026-08-10 | original

read original more articles

Why This Matters

This article highlights a critical vulnerability in the System Management Mode (SMM) of x86 CPUs, demonstrating how an extremely long-running instruction can be exploited to bypass SMM protections. This poses significant security risks for both industry and consumers, as it undermines the foundational trust in hardware-based security mechanisms. Addressing this flaw is essential to prevent potential attacks that could compromise sensitive data and system integrity.

Key Takeaways

SMM can be bypassed using very long machine instructions.
The vulnerability exploits the synchronization mechanism between CPU cores in SMM.
Mitigations are needed to prevent long instruction-based attacks on CPU security features.

smiiiiiiiiiiiiiiii

Exploiting System Management Mode with a very very very very very very very long interrupt.

Overview

It turns out that you can break SMM — the secure, ultra privileged execution environment running invisibly in the background of every x86 CPU — with nothing more than an obscenely long-running machine instruction.

SMM requires that all cores are either in SMM or out of SMM at the same time. Its security model doesn't work without this - when one thread enters SMM, it makes all the others enter too.

To break this, all we need is someone too busy to notice they're supposed to join SMM.

It works something like this:

core 0 - start a long instruction | | | core 1 - invite core 0 to smm | | | core 1 - enter smm | | | core 1 - wait for core 0 | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | core 1 - wait for core 0 | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | core 1 - wait for core 0 | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | core 1 - wait for core 0 | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | core 1 - wait for core 0 | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | core 1 - wait for core 0 | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | core 1 - wait for core 0 | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | core 1 - wait for core 0 | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | core 1 - give up core 1 - do secret smm stuff core 1 - finish smm | | | core 0 - join smm

At this point, core 1 is out of SMM while core 0 is in, letting core 1 attack core 0. Here's the catch: for this to work we need a very, very, verrrrry long instruction — longer than any instruction was ever supposed to take. Most machine instructions on a modern CPU are fast: add takes 1 cycle. To get core 1 to give up waiting on core 0, we need an instruction on core 0 that takes around 4,000,000,000 cycles — over 1 second of wall-clock time.

The One-Second Timeout

... continue reading

Explore topics: smm amd x86 system management mode interrupt