A design flaw in x86 processors dating back nearly two decades could allow rootkits to be installed in low-level computer firmware. This type of malware allows persistent access to a computer with superuser privileges while actively hiding its presence from administrators by embedding itself in core operating system files or other applications.
The specific flaw, which is located in a feature introduced in the x86 architecture in 1997, was revealed last Thursday at the Black Hat by Christopher Domas, a security researcher at the Battelle Memorial Institute.
The researcher demonstrated that through successful exploitation of the vulnerability, attackers are able to install rootkits in the processor's SMM (System Management Mode), a protected area of code that governs all firmware in modern computers.
Once installed, the Rootkit could be used for destructive attacks, such as erasing the UEFI (Unified Extensible Firmware Interface) of modern BIOSes or even re-infecting the operating system despite attempts to sanitize it via format.
According to Domas, Intel is aware of this issue, which has been mitigated in its most recent processors. The company has released several firmware updates for older processors, but not all can be fixed, the researcher says.
To successfully exploit the vulnerability and install the rootkit, attackers would need to have regained kernel or administrator privileges. This means that the flaw cannot be used by itself to compromise a system, but it could make an existing malware infection highly resistant and completely invisible.
Domas demonstrated successful exploitation of the exploit on Intel processors, but noted that AMD x86 processors are also theoretically vulnerable.
