Intel CPU Privilege Escalation Exploit

Eukariote writes "A paper and exploit code detailing a privilege escalation attack on Intel CPUs has just been published. The vulnerability, uncovered by security researchers Joanna Rutkowska (of Blue Pill fame), Rafal Wojtczuk, and, independently, Loic Duflot, makes use of Intel's System Management Mode (SMM). Quote: "The attack allows for privilege escalation from Ring 0 to the SMM on many recent motherboards with Intel CPUs. Rafal implemented a working exploit with code execution in SMM." The implications of this exploit are severe."

Ouch

[Big Hairy Ian]

This could make the apple bricking patch look like a kindergarten party

CD Boot

[Baldrson]

TFA: The malware code takes over a PC with little or no recourse to remove it.

Haven't these guys ever booted from a CD?

But more importantly...

[Anonymous Coward]

... Joanna Rutkowska is hot [zdnet.com]!

Easy workaround

[Anonymous Coward]

Run all code on a 286 or below.

Re:CD Boot

[CannonballHead]

No, really. It takes it over! You can't even come within 5 feet of the case, the malware pushes you back!

Re:But more importantly...

[Ginger Unicorn]

are you kidding? she looks like Q [tripod.com] ;)

Let's go retro

[AlteredEgg]

Wonder if this will spawn a run on Mac G5's.

Re:But more importantly...

[Anonymous Coward]

This [amazonaws.com] is an even better picture. But it's not Joanna.

Re:Easy workaround

[teknopurge]

Your lulz make my Sparcstation weep....

Re:Apple

[Anonymous Coward]

Does this mean Apples are vulnerable?

No. Macs are imperious to rootkits. Now check out this super cool beta version of Safari [tinyurl.com]:

Re:Ouch

[Knara]

A kindergarten party?

Re:CD Boot

[l3ert]

I'll reserve my judgement on this until I read more from someone that owns a clue.

I assume you meant "powns a clue".

Re:Ring of Fire

[geckipede]

if you're on vulnerable hardware, once some malware that uses this trick has gained root, nothing short of physically setting fire to the motherboard will clean it. Reinstalling from scratch can't help you.

Re:Ring of Fire

[Barsteward]

"If you are running in ring zero..."

No-one is going to running in my ring 0 unless they pay a million or two

Re:Ouch

[machine321]

I was on the apple bricking patch for a while, it really helped me quit apple bricking.

Re:But more importantly...

[Anonymous Coward]

Ahem.

http://xkcd.com/322/

Re:Inexcusable

[anss123]

Hard real time is a world in which stuff is expected to actually work every time.

So instead of "real time kernel" it should be called "every time kernel" :-)

Re:Bring back burning at the stake!

[ijakings]

I for one would like to welcome our new flaming devil overlords