Ringhopper: How We Almost Zero-Day'd the World
Benny Zeltser and Jonathan Lusky detail RingHopper, a multi-vendor UEFI vulnerability allowing user-space attackers to jump directly into System Management Mode (SMM).
Summary
The Crown Jewels of System Management Mode
System Management Mode (SMM) is the most privileged execution ring in x86 architecture, executing underneath the operating system kernel and hypervisor with direct access to physical memory.
Discovering Industry-Wide EDK2 Flaws
Benny Zeltser and Jonathan Lusky uncover RingHopper, a pervasive family of vulnerabilities across major UEFI firmware implementations affecting billions of commercial devices.
Engineering the Leap from User-Land to Ring -2
The researchers detail the exploitation chain, manipulating SMI handlers and EDK2 memory structures to escalate privileges from unprivileged user-space directly into SMM.
Coordinated Disclosure and Firmware Hardening
Working with over eight major hardware vendors to coordinate firmware patches highlights the systemic difficulty of remediating low-level firmware flaws at global scale.
Related talks
Main Stage·44 min
Enrique Nissim · Krzysztof Okupski
Enrique Nissim and Krzysztof Okupski disclose AMDSinkclose, a vulnerability allowing Ring -2 execution and System Management Mode takeover across millions of AMD processors.
Main Stage·44 min
Yuriy Bulygin
Intel Security researcher Yuriy Bulygin explores firmware and hardware emulation vulnerabilities in modern hypervisors, demonstrating SMM privilege escalation from guest VMs.
Main Stage·44 min
Enrique Nissim · Krzysztof Okupski
Silicon-level vulnerability in AMD processor System Management Mode enabling persistent Ring-2 privilege escalation invisible to hypervisors.