Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

The APIC's registers are an unusual form of per core black magic. As far as I know, no other memory addresses behave in the same way -- visible and reacting only to that specific core. It's unsurprising that Intel initially didn't catch this case.

Fortunately, it's `just` a root => SMM escalation, which are already more common than anyone would really like to admit.



Did I misread? I thought it only requires userland?


The presentation certainly makes it seem that way. The dramatic "POC" with the magic number only works with the rootkit already installed.

The proceedings paper has much more detail[1]. Installing the rootkit requires some very careful crafting and requires ring 0 to request memory remapping and set up far pointer descriptors.

1. (pdf) https://www.blackhat.com/docs/us-15/materials/us-15-Domas-Th...


You didn't read past the first page. The only userland thing is activating the rootkit.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: