DEF CON 33 - Conjuring Hardware Failures for Cross-ring Privilege Escalation - Christopher Domas

Optimized Summary:

BLUF:
The video reveals a novel method to generate machine check exceptions (MCEs) on-demand using software, enabling targeted privilege escalation into highly secure execution modes—specifically System Management Mode (SMM, ring -2)—by exploiting hardware-level error handling and interrupt vulnerabilities.

Key Takeaways (Refined & Structured):

1. On-Demand Machine Check Generation
   Machine check exceptions—designed to signal catastrophic hardware failures—are typically rare and unpredictable. This research demonstrates that they can be triggered reliably via software by accessing non-existent PCI devices through unaligned, 8-byte MMIO accesses, which generate a master abort and propagate into a machine check. This is a first demonstration of on-demand MCE generation from user-space.

2. A "Fuse" Instruction to Delay Machine Checks
   By violating standard CPU specifications—using the 8-byte RAX register instead of the mandated EAX and performing an unaligned 4-byte access—the researchers construct a custom "fuse" instruction. This instruction significantly delays MCE generation:

   • Standard MMIO accesses take ~700 cycles.
   • Unaligned, 8-byte accesses on a slow PCI device extend this to 12,000 cycles.
   • The delay is achieved by breaking the MMIO access into three 4-byte segments, with the final segment hitting a non-existent device, triggering a master abort.
     This creates a tunable, precise timing window for privilege escalation.

3. Exploitation of SMM (Ring -2) via Timing Windows
   The attack targets SMM, a privileged execution mode invisible to the OS and hypervisor, with access to firmware and persistent implants. The vulnerability arises because:

   • SMM inherits an unmodified IDTR (Interrupt Descriptor Table), meaning any exception—like a machine check—is routed to an untrusted handler.
   • The CPU design assumes secure mode execution, b