DEF CON 32 - AMD Sinkclose-Universal Ring2 Privilege Escalation - Enrique Nissim, Krzysztof Okupski

A critical vulnerability in AMD processors' SMM architecture allows attackers to achieve arbitrary code execution and full system control via memory remapping, bypassing OS and hypervisor protections. This flaw enables persistent firmware implants that survive OS reinstallation and can disable secure boot permanently.

Key Takeaways:
• Misconfigured TC mask register allows ring-zero code to modify memory access behavior 6:04.
• The T-close bit, when set from ring zero, redirects data accesses to MMIO, enabling execution redirection to attacker-controlled memory 8:04.
• A memory overflow in the GDT allows attackers to redirect execution to malicious payloads by exploiting address wrapping 27:04.
• Exploitation works across multiple cores due to AMD’s symmetric multi-threading, requiring synchronization to control both logical cores 29:13.
• Vulnerable systems can be infected with firmware-level malware that persists through OS reinstalls and permanently disables secure boot 35:45.

This vulnerability affects hundreds of millions of AMD systems, including Ryzen and EPYC processors, and can be mitigated via microcode updates or firmware patches that block access to critical SMM registers.

Sources:

• 6:04 Discussion of TC mask register misconfiguration enabling ring-zero access.
• 8:04 Explanation of T-close bit allowing data access redirection to MMIO.
• 27:04 GDT overflow enabling execution redirection via address wrapping.