Researchers Demonstrate AMD Sinkclose Privilege Escalation into System Management Mode

Summary

Researchers demonstrate Sinkclose, an AMD processor flaw that can elevate ring 0 access to system management mode and enable firmware tampering. AMD provided a microcode update, though the researchers said it might not cover every affected system.

Key points

• Sinkclose exploits an AMD processor configuration flaw to execute attacker-controlled code in system management mode, below the operating system and hypervisor.
• The researchers demonstrated escalation from ring 0 to ring -2 and modified the firmware boot logo on a 2023 laptop.
• Depending on platform protections, the researchers said the flaw could enable Secure Boot compromise, bootkits or persistent firmware implants.
• The researchers reported that Ryzen, Threadripper and EPYC processors were affected and estimated that hundreds of millions of chips could be exposed.
• AMD provided a microcode update; the researchers cautioned that some affected systems might not be covered and described potential OEM and hypervisor mitigations.
• The issue was assigned CVE-2023-31315. At the time of the presentation, the researchers planned to release exploit code in mid-November.