Two Undocumented x86 Instructions Allegedly Found that can Modify Microcode

[InsertPi]

 

Summary

As said in the title, Mark Ermolov, Dmitry Sklyarov, and Maxim Goryachy together have allegedly found two undocumented x86 instructions that can modify the architectural state of Intel CPUs. This means that they can modify microcode (for those unaware, this is effectively the code that makes your CPU do what it does). Mark claims that it's decoded in all modes, including user mode, but that the "[microcode] in MSROM throws #UD if not in Red Unlocked state."

 

Ermolov says that details will be posted "a little later." Will add to this post with updates as I see them.

 

Quotes

Quote

"[Y]es, they can modify microcode."

-Mark Ermolov (@_markel__ on Twitter)

 

My thoughts

This has serious implications for computer security, as an exploit could potentially allow hackers to install malicious microcode onto your CPU, change processor behavior, or bypass lots of contemporary CPU-level security measures. As we know, Meltdown was a problem that was patched by updating Intel microcode. Could an exploit un-install this patched microcode, re-exposing systems to serious exploits like Meltdown and Spectre? 

 

Sources

EDIT 1: After doing some research myself, when Mark says "[microcode] in MSROM throws #UD if not in Red Unlocked state," this effectively amounts to the fact that your CPU has to be in debug mode, which itself usually requires a compromised Management Engine (in which case, these new opcodes aren't even your biggest worry). #UD is an error on Intel CPUs that means "undefined instruction," and Red Unlocked state usually requires a hacked ME. So, this discovery will likely cause in influx in related security research, but it in itself should not be too detrimental. 

Edited March 20, 2021 by iamaperson620

[FakeKGB]

"Grandpa, why did you put these in the x86 instruction set when you invented it?"
 

I'm curious where this will go.

Any thoughts on name ideas?

[AbydosOne]

4 minutes ago, FakeKGB said:

Any thoughts on name ideas?

OhShIntel

[Radium_Angel]

38 minutes ago, FakeKGB said:

"Grandpa, why did you put these in the x86 instruction set when you invented it?"
 

I'm curious where this will go.

Any thoughts on name ideas?

Has Code Red been used already?

 

 

[DildorTheDecent]

It's undocumented for you and me. The feds have probably known about this for years.

[StDragon]

Is this the precursor as in Fight Club when the entire system breaks down via the most epic global hack ever?

 

*golf clap*

[TetraSky]

Intel... 

 

What's with these undocumented instructions though? Is this just something Intel put in for future planned feature?

[ARikozuM]

Are those last names even REAL!?

 

/s

[Arika S]

3 hours ago, iamaperson620 said:

After doing some research myself, when Mark says "[microcode] in MSROM throws #UD if not in Red Unlocked state," this effectively amounts to the fact that your CPU has to be in debug mode, which itself usually requires a compromised Management Engine (in which case, these new opcodes aren't even your biggest worry). #UD is an error on Intel CPUs that means "undefined instruction," and Red Unlocked state usually requires a hacked ME. So, this discovery will likely cause in influx in related security research, but it in itself should not be too detrimental. 

So basically another example of:

If your PC is in a state where this can actually be used, you're already screwed regardless if anyone has run any microcode updates.

 

If someone has the kind of control over your Computer that they can install a hacked ME, yeah, maybe better to just throw it out completely.

[InsertPi]

2 hours ago, TetraSky said:

Intel... 

 

What's with these undocumented instructions though? Is this just something Intel put in for future planned feature?

Likely these are debugging instructions that Intel engineers use when developing CPUs. By only enabling their execution when in debug mode, it's "in theory" safe, so they never removed them before production.

[straight_stewie]

5 hours ago, iamaperson620 said:

#UD if not in Red Unlocked state."

Then this entire discovery is academically interesting, but a non-issue for users.

If someone can get your processor to enter debug mode (especially without unfettered physical access) then there's a much bigger problem somewhere else, and the end user is already fxed.

 

4 hours ago, DildorTheDecent said:

The feds have probably known about this for years.

The feds can, and have, installed hypervisors that can hide themselves in certain hard drive controllers. This was the major capability of the EquationGroup's espionage platforms, or so says Kaspersky.