3 ms·
The APIC's registers are an unusual form of per core black magic. As far as I know, no other memory addresses behave in the same way -- visible and reacting onl
by strstr 11y ago
The APIC's registers are an unusual form of per core black magic. As far as I know, no other memory addresses behave in the same way -- visible and reacting only to that specific core. It's unsurprising that Intel initially didn't catch this case.
Fortunately, it's `just` a root => SMM escalation, which are already more common than anyone would really like to admit.
- eximius 11y agoDid I misread? I thought it only requires userland?
- 3JPLW 11y agoThe presentation certainly makes it seem that way. The dramatic "POC" with the magic number only works with the rootkit already installed. The proceedings paper has much more detail[1]. Installing the rootkit requires some very careful crafting and requires ring 0 to request memory remapping and set up far pointer descriptors. 1. (pdf) https://www.blackhat.com/docs/us-15/materials/us-15-Domas-The-Memory-Sinkhole-Unleashing-An-x86-Design-Flaw-Allowing-Universal-Privilege-Escalation-wp.pdf https://www.blackhat.com/docs/us-15/materials/us-15-Domas-Th...
- TazeTSchnitzel 11y agoYou didn't read past the first page. The only userland thing is activating the rootkit.