Video: AMD and Microsoft join forces to block Spectre attacks.
Yuriy Bulygin, the former head of Intel's advanced threat team, has published research showing that the Spectre CPU flaws can be used to break into the highly privileged CPU mode on Intel x86 systems known as System Management Mode (SMM).
Spectre and Meltdown vulnerabilities[1] enable software attacks using CPU design flaws common to Intel, AMD, and Arm chips to access secrets stored in memory.
Bulygin, who has launched security firm Eclypsium, has modified Spectre variant 1 with kernel privileges to attack a host system's firmware and expose code in SMM, a secure portion of BIOS or UEFI firmware.
SMM resides in SMRAM, a protected region of physical memory that should only be accessible by BIOS firmware and not the operating system kernel, hypervisors or security software.
SMM handles especially disruptive interrupts and is accessible through the SMM runtime of the firmware, knows as System Management Interrupt (SMI) handlers.
As a former Intel researcher explained[2] in a 2013 paper, when an SMI event occurs, say, due to thermal throttling or system health checks, all the CPU's cores enter SMM or system management mode.
"Because SMM generally has privileged access to physical memory, including memory isolated from operating systems, our research demonstrates that Spectre-based attacks can reveal other secrets in memory (eg, hypervisor, operating system, or application)," Bulygin explains[3].
To expose code in SMM, Bulygin modified a publicly available proof-of-concept Spectre 1 exploit running with kernel-level privileges to bypass Intel's System Management Range Register (SMRR), a set or range registers that protect SMM memory.
"These enhanced Spectre attacks allow an unprivileged attacker to read the contents of memory, including