Mark Ermolov (@_markel___) on X

Wow, we (+

and

) have found two undocumented x86 instructions in Intel CPUs which completely control microarchitectural state (yes, they can modify microcode)

They're decoded in all modes (even in User Mode) but the ucode in MSROM throws #UD if not in Red Unlocked state. All details a little later...

For our followers: The likely implication is that an attacker who can access the machine in early-boot mode, can circumvent Intel's signed firmware protections. The ultimate impact remains to be seen.

Does this relate to Minix running in the shadows on Intel's hardware in any way? What I recall was that in Intel's silicon was an embedded Minix "security management" function that was operating entirely outside of the local control IIRC. I think it was remote manage "feature".

Having the platform red-unlocked is already game over, perhaps except for SGX.