what this allows an attacker to do?
It allows an attacker to execute arbitrary code in System Management Mode (SMM), a highly privileged execution mode of x86 processors. This mode is transparent to the Operating System (OS) and it is more privileged than any other mode. If an attacker can execute code in SMM, it basically owns the platform/computer (more powerful than any other rootkit in the kernel of your OS).
It is worth noting that such vulnerability has a requirement: you need kernel privileges in order to trigger a System Management Interrupt (SMI), to execute the exploit.
There is two approaches for the attacker:
- It can overwrite the firmware flash storage and disable some security features at boot. Then, even if you erase the content of your hard disk, or buy another one it can reinfect the OS without any problem. Furthermore, detecting or removing the malware from the firmware will be a hard task since it controls one of the early piece of code executing on the computer.
However, a measured boot using a Trusted Platform Module (TPM) chip could detect the modification of the firmware flash and that some security features are disabled at boot, because the measurements made (cryptographic hashes) are not genuine. Such detection is possible if the measured boot process is properly implemented by the vendor. The measurement process relies on a core root of trust where the first component measuring the next one is trusted. Hence, if this first component is the firmware contained in the flash, the attacker can fake the measurements without being detected.
- It can be stealthy and just overwrite the code executed in SMM, located in SMRAM, without modifying the flash. This way it controls the code executed in SMM and can monitor or modify the behavior of the OS. The stealthiness comes from the fact that if the computer is rebooted, there is no traces of the attack in the flash (since everything was in RAM). Lots of computers, however, do not reboot that often (e.g. servers), hence the attacker does not need to reinfect the machine to still have control over it.