AMD Sinkclose: Universal Ring-2 Privilege Escalation
Silicon-level vulnerability in AMD processor System Management Mode enabling persistent Ring-2 privilege escalation invisible to hypervisors.
Summary
System Management Mode Fundamentals
System Management Mode (SMM) is one of the most powerful execution modes in the x86 architecture and code at this level is invisible to the Hypervisor and OS-level protections, including anti-cheat engines and anti-virus systems. While the BIOS ecosystem's complexity has led to a multitude of vulnerabilities in firmware over time, vendors are now making strides in delivering patches with greater speed and efficiency. Unfortunately, these efforts are not enough in the presence of a CPU vulnerability.
Flaw in AMD Hardware SMM Isolation
When researching the AMD processor, our team noticed a flaw in one of the critical components required for securing SMM. This silicon-level issue appears to have remained undetected for nearly two decades.
Universal Ring-2 Exploit Engineering
This presentation starts by providing an introduction to SMM and the security mechanisms that the AMD processor provides to support it. Subsequently, it delves into the CPU design flaw and the complete methodology and engineering used to create a universal ring -2 privilege escalation exploit.
Related talks
Main Stage·44 min
Enrique Nissim · Krzysztof Okupski
Enrique Nissim and Krzysztof Okupski disclose AMDSinkclose, a vulnerability allowing Ring -2 execution and System Management Mode takeover across millions of AMD processors.
Main Stage·42 min
Philippe Laulheret
Demonstrates the ReVault hardware attack targeting secure microcontrollers embedded across over 100 enterprise laptop models to compromise master keys.
Main Stage·45 min
Christopher Domas
Christopher Domas demonstrates how software-controlled microarchitectural stresses induce transient hardware faults to achieve cross-ring privilege escalation.