Exploiting System Management Mode with a very long interrupt
Summary
The article presents a PoC showing that SMM can be broken by a single extremely long instruction, causing a core to remain outside SMM and enabling privilege escalation. It uses a Zen 3 Ryzen 7 5800H-specific setup with a slow MMIO read and a wide vector load to stall the rendezvous for about a second, and it references several CVEs related to SMM. It also offers porting guidance and discusses defensive considerations for mitigating such desynchronization attacks.