安全研究人员发现了x86处理器的一个新安全漏洞，可以通过执行超长指令来破坏系统管理模式（SMM）的同步机制[1]。该漏洞利用了一个关键的系统假设——SMM要求所有CPU核心必须同时进入或退出SMM环境，而攻击者可以通过使某个核心在超长指令执行期间保持在SMM外部，从而打破这一同步要求[1]。
这一发现对现有的安全防护产生了重大影响。攻击需要执行一条耗时超过1秒的机器指令，具体为约4000000000个处理器周期[1]。概念验证使用vmovdqu指令从特定内存地址读取，针对Zen 3 Ryzen 7 5800H处理器进行了测试[1]。由于x86固件等待所有核心进入SMM的超时时间仅为1秒，这为攻击提供了时间窗口[1]。
更值得关注的是，这种攻击方式突破了以往的技术限制——不再需要物理访问硬件或恶意硬件的支持，软件可以在SMM执行期间直接运行[1]。这意味着已知的100多个SMM TOCTOU类漏洞现在都可能通过纯软件方式被利用[1]。
Security researchers have identified a critical vulnerability in x86 processors that exploits the synchronization mechanism of System Management Mode (SMM) through the execution of exceptionally long instructions.[1] By executing machine instructions that take over one second to complete, attackers can prevent a CPU core from entering SMM, allowing it to continue executing outside the protected mode and thereby bypassing previously considered secure firmware protections.[1]
The vulnerability undermines a fundamental assumption of SMM's security model: that all processor cores must simultaneously enter or exit SMM.[1] The exploit requires a single machine instruction with an execution time of approximately 4 billion clock cycles, exceeding the one-second timeout that x86 firmware uses while waiting for all cores to enter SMM.[1] A proof-of-concept demonstration targeting the Zen 3 Ryzen 7 5800H processor was achieved by executing a vmovdqu instruction reading from address 0xfcc68860, which performs a load operation on a slow memory-mapped input/output address.[1]
The discovery has significant implications for existing security patches, as over 100 previously identified SMM time-of-check-time-of-use (TOCTOU) vulnerabilities now become exploitable through software alone, without requiring physical access to the system or malicious hardware.[1] This SMI desynchronization technique removes prerequisites that earlier mitigations had assumed necessary, substantially expanding the attack surface of affected systems.[1]