In a recent statement to WIRED, AMD highlighted the complexity of exploiting Sinkclose, a vulnerability that requires access to a computer’s kernel, the core of its operating system. This level of access is akin to bypassing a bank’s alarms, guards, and vault door to access its safe-deposit boxes. Nissim and Okupski, researchers at IOActive, argue that while exploiting Sinkclose demands kernel-level access, vulnerabilities in Windows and Linux are exposed practically every month. They suggest that sophisticated state-sponsored hackers likely already possess techniques to exploit these vulnerabilities, making Sinkclose the next step in their arsenal.
The Sinkclose technique developed by Nissim and Okupski leverages an obscure feature of AMD chips called TClose. This feature, designed to maintain compatibility with older devices, allows for remapping memory addresses to access System Management Random Access Memory (SMRAM). By exploiting TClose’s remapping capabilities, the researchers were able to manipulate the processor to execute their own code at a highly privileged SMM level. Okupski describes this exploit as the most complex bug he has ever exploited.
Nissim and Okupski’s interest in AMD’s architecture stemmed from a belief that it had not received as much scrutiny as Intel, despite its increasing market share. They discovered the critical TClose edge case that enabled Sinkclose by meticulously studying AMD’s documentation. After notifying AMD of the flaw in October of last year, they have waited nearly 10 months to allow the company time to prepare a fix.
For users looking to protect themselves from Sinkclose, Nissim and Okupski anticipate that patches for Windows machines will be integrated into updates provided by computer manufacturers to Microsoft. However, patches for servers, embedded systems, and Linux machines may require more manual intervention. They caution users not to underestimate the severity of Sinkclose and urge them to patch their systems promptly, as sophisticated hackers may already be aware of the exploit or could discover it after the researchers present their findings at Defcon.
Despite the deep level of access required to exploit Sinkclose, Nissim and Okupski emphasize the importance of implementing any available fixes without delay. They warn that if the foundation of a system is compromised, its overall security is at risk. By staying proactive and vigilant, users can mitigate the potential impact of vulnerabilities like Sinkclose and safeguard their systems against malicious attacks.