{"id":119301,"date":"2024-08-10T09:43:01","date_gmt":"2024-08-10T07:43:01","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/sinkclose-uyazvimost-v-cpu-amd-pozvolyayushhaya-poluchit-dostup-k-smm"},"modified":"2024-08-10T09:43:01","modified_gmt":"2024-08-10T07:43:01","slug":"sinkclose-uyazvimost-v-cpu-amd-pozvolyayushhaya-poluchit-dostup-k-smm","status":"publish","type":"post","link":"https:\/\/prohoster.info\/en\/blog\/news\/sinkclose-uyazvimost-v-cpu-amd-pozvolyayushhaya-poluchit-dostup-k-smm","title":{"rendered":"Sinkclose \u2014 a vulnerability in AMD CPUs that allows access to SMM","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"
Researchers from IOActive have identified a vulnerability (CVE-2023-31315) in AMD processors that allows, with privileged local access to the system, changes to the System Management Mode (SMM) configuration, even if the SMM Lock mechanism is enabled. This vulnerability potentially enables code execution at the SMM level. The SMM level, which has a higher priority than the hypervisor and the ring-0 protection level, grants unrestricted access to all system memory and could be used to control the operating system. <\/p>\n
The vulnerability, codenamed Sinkclose, is caused by improper checks of model-specific registers (MSR). An area of physical memory pages is reserved for SMM, which blocks access at the memory controller level. The identified vulnerability allows bypassing this lock by manipulating certain MSRs that were not prohibited from writing, despite the SMM Lock being enabled. <\/p>\n
Exploitation of the vulnerability can occur from ring-0, where the operating system kernel operates, and can be used, for instance, to maintain presence after exploiting other system vulnerabilities or employing social engineering methods. The operating system cannot monitor or control code execution at the SMM level, which could be used to modify firmware and place hidden malware or rootkits undetectable from the operating system, as well as to disable integrity verification at boot time and launch attacks on hypervisors to bypass verification mechanisms in virtual environments. <\/p>\n
The vulnerability appears in nearly all AMD chips produced since 2006, including the AMD EPYC processor series (1st-4th generation), Ryzen (R1000, R2000, 3000-8000, V1000, V2000, V3000), Athlon 3000, and Threadripper PRO. Microcode updates to mitigate the vulnerability have already been released for mobile and desktop series of EPYC and Ryzen CPUs. Planned updates for embedded CPU models are set to be published in October. The only way to remove malware implanted through an SMM attack is to clear the memory using a physically connected SPI Flash programmer. \n Source: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"