skitter-creek-bath-salts

skitter-creek-bath-salts Desbloqueandotodo en la CPU con el scrambling de DRAM — PSP, C6, microcódigo, SMM, y cualquier otra cosa que las especificaciones omitieron. &x == &x. Normalmente. Manipula el controlador de DRAM y una dirección puede terminar donde quieras en la memoria...

SmmBackdoor

适用于基于 UEFI 平台的 SMM 后门 !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! 这是一个已弃用的遗留项目，当前版本的后门请 查看 SMM Backdoor Next Gen 项目页面及其 文档： https://github.com/Cr4sh/SmmBackdoorNg !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! 有关此项目的更多信息，请阅读以下文章：...

Platbox

Platbox UEFI和SMM评估工具 功能特点 Platbox 是一款帮助评估平台安全性的工具： 转储安全相关的平台寄存器 Flash 锁定 MMIO 和重映射锁定 SMM 基址与锁定 MSRs 对设备PCI配置空间的读写访问。 对物理内存和虚拟内存的读写。 允许分配物理内存并将内存映射到用户模式。 读写MSRs。 将SPI闪存内容BIOS转储到文件。 基础SMI模糊测试器。 将S3引导脚本来自SMM-Lockbox转储到文件。 转储EFI内存映射目前仅Linux。 列出UEFI变量。 支持Linux和Windows。 支持Intel和AMD。...

smm_usbrt_poc

UsbRt SMM Privilege Elevation 这是一个概念验证代码，演示了CVE-2017-5721漏洞的利用。该PoC会导致系统因发生机器检查异常而完全卡住。 您只需安装CHIPSEC Framework即可。如果您有Intel设备，别忘了在/etc/default/grub中添加GRUBCMDLINELINUXDEFAULT="quiet splash acpi=off"。 使用示例： sudo python poc.py...

SmmExploit

SmmExploit 这是针对 CVE-2021-26943 的一份报告和利用代码，该漏洞是华硕 UX360CA BIOS 版本 303 中存在的内核到 SMM 本地权限提升漏洞。该问题已在 版本 304 中修复。 问题描述 摘要 UX360CA BIOS 版本 303 包含 3 个存在漏洞的模块，允许具有 ring0 权限的攻击者覆盖几乎任意物理内存（包括 SMRAM），并在 SMM 中执行任意代码。 这些模块的标识如下： 名称| GUID| SHA256 ---|---|--- UsbRt| 04EAAAA1-29A1-11D7-8838-00500473D4EB|...

CVE-2025-55575

smm-panel-sqliCVE-2025-55575 基于时间的SMM面板SQL注入检测 概述 该模板通过 HTTP POST 请求向 /ajaxdata 发送数据，检测 SMM 面板中 servicedetail 参数是否存在基于时间的 SQL 注入 漏洞。利用该漏洞，远程攻击者可以访问敏感数据或提升权限。 作者： Aether 严重性： Critical 标签： sqli, mysql, timing, dork:'intitle:"1 SMM Panel "' "smm panel" 参考：...

smiiiiiiiiiiiiiiii

smiiiiiiiiiiiiiiii 利用一个非常非常非常非常非常非常长的中断来攻击系统管理模式（SMM）。 概述 事实证明，你可以仅凭一条极其耗时的机器指令，就攻破 SMM——这个在每颗 x86 CPU 后台隐形运行的安全、超特权执行环境。 SMM 要求所有核心要么同时处于 SMM 中，要么同时处于 SMM 外。它的安全模型离不开这一点——当一个线程进入 SMM 时，它会强制所有其他线程也进入 SMM。 要打破这一点，我们只需要一个忙到没注意到自己应该加入 SMM 的核心。 其原理大致如下： 核心 0 - 开始一条长指令 | | | 核心 1 - 邀请核心 0 进入 smm | | |...

GIGABYTE-H510M-K-V2-BIOS-SMM-Reverse-Engineering-CVE-2025-7026-7027-7028-7029-Research

技嘉 H510M K V2 BIOS SMM 逆向工程与 CVE-2025-7026/7027/7028/7029 研究 针对技嘉 H510M K V2（H510MKV2.F3）BIOS 镜像的静态逆向工程：完整地对 PI 规范 SMM Core 内存分配器进行 UEFI 固件卷提取分析，并定向搜寻 GIGABYTE/Binarly 于 2025 年披露的四个 SMM 内存破坏漏洞（CVE-2025-7026、CVE-2025-7027、CVE-2025-7028、CVE-2025-7029）。 状态：4 个 CVE 中已确认 1 个存在（CVE-2025-7027）。另外 3...

Rocky Linux 9 [CIQ] Security Update: microcode_ctl Multiple Vulnerabilities (crlsa-2026_68011)

The Rocky Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the CIQ crlsa-202668011 advisory. kernel: hypervisor: Intel Processors: Privilege escalation in Ring 0 via improper value handling CVE-2025-35973 kernel: microcodectl: Intel Xeon 6...

AlmaLinux 9.2 [TuxCare] Security Update: iwl100-firmware / iwl1000-firmware / iwl105-firmware / etc (ALMALINUX9.2:CLSA-2024:1729015920)

The AlmaLinux 9.2 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2024:1729015920 advisory. - Improper validation in a model specific register MSR could allow a malicious program with ring0 access to modify SMM configuration while SM...

CentOS Linux 7 [TuxCare] Security Update: iwl100-firmware / iwl1000-firmware / iwl105-firmware / etc Multiple Vulnerabilities (CENTOS7:CLSA-2024:1727288321)

The CentOS Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS7:CLSA-2024:1727288321 advisory. - Improper or unexpected behavior of the INVD instruction in some AMD CPUs may allow an attacker with a malicious hypervisor to affect...

Rocky Linux 8 [CIQ] Security Update: microcode_ctl Multiple Vulnerabilities (crlsa-2026_65147)

The Rocky Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the CIQ crlsa-202665147 advisory. kernel: hypervisor: Intel Processors: Privilege escalation in Ring 0 via improper value handling CVE-2025-35973 kernel: microcodectl: Intel Xeon 6...

Rocky Linux 10.2 [CIQ] Security Update: microcode_ctl Multiple Vulnerabilities (crlsa-2026_67979)

The Rocky Linux 10.2 host has a package installed that is affected by multiple vulnerabilities as referenced in the CIQ crlsa-202667979 advisory. kernel: hypervisor: Intel Processors: Privilege escalation in Ring 0 via improper value handling CVE-2025-35973 kernel: microcodectl: Intel Xeon 6...

InsydeH2O IHISI SMM is vulnerable to unsafe memory write operations

Overview An Out-of-bounds Write vulnerability in the InsydeH2O IHISI software used by HP PC BIOS can allow a local attacker with OS kernel privileges to perform arbitrary physical memory writes, including writes to System Management RAM SMRAM. Because the vulnerable code executes in System...

CVE-2026-98164

A flaw was found in the Linux kernel's KVM Kernel-based Virtual Machine subsystem. When virtualized System Management Mode SMM is enabled, memory write tracking only checks the active memory slot rather than all address spaces sharing shadow pages. An attacker inside a guest virtual machine can...

CVE-2026-81627

A flaw was found in QEMU. The VAPIC setup hypercall in hw/i386/vapic.c does not validate that the writable RAM alias remains within the option ROM window. A privileged guest user on a Q35/KVM machine can position this alias over locked SMRAM, bypassing chipset DLCK protection and injecting code...

CVE-2026-81627

A flaw in QEMU 's VAPIC setup hypercall (hw/i386/vapic.c) fails to validate that the writable RAM alias stays within the option ROM window. A privileged guest on a Q35/KVM machine can position this alias over locked SMRAM , bypassing chipset D_LCK protection and injecting code into System Managem...

CVE-2026-81627 Qemu-kvm: vapic writable rom alias can escape the option-rom window and expose locked smram

A flaw was found in QEMU. The VAPIC setup hypercall in hw/i386/vapic.c does not validate that the writable RAM alias remains within the option ROM window. A privileged guest user on a Q35/KVM machine can position this alias over locked SMRAM, bypassing chipset DLCK protection and injecting code...

CVE-2026-81627

A flaw was found in QEMU. The VAPIC setup hypercall in hw/i386/vapic.c does not validate that the writable RAM alias remains within the option ROM window. A privileged guest user on a Q35/KVM machine can position this alias over locked SMRAM, bypassing chipset DLCK protection and injecting code...

Unity Linux 20.1050a / 20.1060a / 20.1070a Security Update: microcode_ctl (UTSA-2026-110881)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-110881 advisory. Improper handling of overlap between protected memory ranges for some IntelR XeonR 6 processors when using IntelR TDX within SMM may allow an escalation of privilege...