{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,7,2]],"date-time":"2026-07-02T16:16:49Z","timestamp":1783009009980,"version":"3.54.5"},"reference-count":48,"publisher":"IEEE","license":[{"start":{"date-parts":[[2022,5,1]],"date-time":"2022-05-01T00:00:00Z","timestamp":1651363200000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-009"},{"start":{"date-parts":[[2022,5,1]],"date-time":"2022-05-01T00:00:00Z","timestamp":1651363200000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-001"}],"funder":[{"DOI":"10.13039\/100006190","name":"Research and Development","doi-asserted-by":"publisher","id":[{"id":"10.13039\/100006190","id-type":"DOI","asserted-by":"publisher"}]}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":[],"published-print":{"date-parts":[[2022,5]]},"DOI":"10.1109\/sp46214.2022.9833723","type":"proceedings-article","created":{"date-parts":[[2022,7,27]],"date-time":"2022-07-27T19:28:05Z","timestamp":1658950085000},"page":"1623-1637","source":"Crossref","is-referenced-by-count":11,"title":["Finding SMM Privilege-Escalation Vulnerabilities in UEFI Firmware with Protocol-Centric Static Analysis"],"prefix":"10.1109","author":[{"given":"Jiawei","family":"Yin","sequence":"first","affiliation":[{"name":"Institute of Information Engineering, Chinese Academy of Sciences, Beijing, China and School of Cyber Security, University of Chinese Academy of Sciences,Beijing,China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Menghao","family":"Li","sequence":"additional","affiliation":[{"name":"Institute of Information Engineering, Chinese Academy of Sciences, Beijing, China and School of Cyber Security, University of Chinese Academy of Sciences,Beijing,China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Wei","family":"Wu","sequence":"additional","affiliation":[{"name":"Huawei Technologies"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Dandan","family":"Sun","sequence":"additional","affiliation":[{"name":"Institute of Information Engineering, Chinese Academy of Sciences, Beijing, China and School of Cyber Security, University of Chinese Academy of Sciences,Beijing,China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Jianhua","family":"Zhou","sequence":"additional","affiliation":[{"name":"UNSW Sydney"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Wei","family":"Huo","sequence":"additional","affiliation":[{"name":"UNSW Sydney"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Jingling","family":"Xue","sequence":"additional","affiliation":[{"name":"UNSW Sydney"}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"263","reference":[{"key":"ref13","article-title":"Static detection of c++ vtable escape vulnerabilities in binary code","author":"dewey","year":"2012","journal-title":"NDSS"},{"key":"ref35","year":"2018","journal-title":"Introducing project mu"},{"key":"ref12","year":"2019","journal-title":"uefi org"},{"key":"ref34","year":"2021","journal-title":"EDK II Project"},{"key":"ref15","year":"2021","journal-title":"Hex-rays ida pro A powerful disassembler and a versatile debugger"},{"key":"ref37","first-page":"167","article-title":"kafl: Hardware-assisted feedback fuzzing for OS kernels","author":"schumilo","year":"2017","journal-title":"26th USENIX Security Symposium (USENIX Security 17)"},{"key":"ref14","doi-asserted-by":"publisher","DOI":"10.14722\/ndss.2021.24386"},{"key":"ref36","year":"2020","journal-title":"2020 CWE Top 25 Most Dangerous Software Weaknesses"},{"key":"ref31","first-page":"1769","article-title":"Detecting missing-check bugs via semantic- and context-aware criticalness and constraints inferences","author":"lu","year":"2019","journal-title":"28th USENIX Security Symposium (USENIX Security 19)"},{"key":"ref30","doi-asserted-by":"publisher","DOI":"10.1109\/DSN.2018.00052"},{"key":"ref11","author":"engblom","year":"2017","journal-title":"Finding bios vulnerabilities with symbolic execution and virtual platforms"},{"key":"ref33","doi-asserted-by":"publisher","DOI":"10.1145\/199448.199462"},{"key":"ref10","author":"myers","year":"2018","journal-title":"Using the intel stm for protected execution"},{"key":"ref32","doi-asserted-by":"publisher","DOI":"10.1145\/3243734.3243844"},{"key":"ref2","author":"oleksiuk","year":"2016","journal-title":"Exploiting ami aptio firmware on example of intel nuc"},{"key":"ref1","year":"2021","journal-title":"Total unit shipments of personal computers (PCs) worldwide from 2006 to 2020"},{"key":"ref17","doi-asserted-by":"publisher","DOI":"10.1109\/CNS48642.2020.9162164"},{"key":"ref39","author":"hertz","year":"2017","journal-title":"TriforceAFL"},{"key":"ref16","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2016.17"},{"key":"ref38","first-page":"33","article-title":"Coverage-guided kernel fuzzing with syzkaller","volume":"2","author":"drysdale","year":"2016","journal-title":"Linux Weekly News"},{"key":"ref19","year":"2021","journal-title":"Remote Procedure Call"},{"key":"ref18","doi-asserted-by":"publisher","DOI":"10.14722\/ndss.2017.23225"},{"key":"ref24","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2013.44"},{"key":"ref46","first-page":"2379","article-title":"FIRMSCOPE: Automatic uncovering of privilege-escalation vulnerabilities in pre-installed apps in android firmware","author":"elsabagh","year":"2020","journal-title":"29th USENIX Security Symposium (USENIX Security 20)"},{"key":"ref23","year":"2020","journal-title":"Intel hardware shield Trustworthy smm on the intel vpro platform"},{"key":"ref45","first-page":"1007","article-title":"DR. CHECKER: A soundy analysis for linux kernel drivers","author":"machiry","year":"2017","journal-title":"26th USENIX Security Symposium (USENIX Security 17)"},{"key":"ref26","doi-asserted-by":"publisher","DOI":"10.1145\/2810103.2813673"},{"key":"ref48","first-page":"255","article-title":"Effective static analysis of concurrency use-after-free bugs in linux device drivers","author":"bai","year":"2019","journal-title":"Proceedings of the 2019 USENIX Conference on Usenix Annual Technical Conference ser USENIX ATC ’19"},{"key":"ref25","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2016.60"},{"key":"ref47","doi-asserted-by":"publisher","DOI":"10.1109\/ASE.2019.00034"},{"key":"ref20","year":"2021","journal-title":"Component Object Model"},{"key":"ref42","doi-asserted-by":"publisher","DOI":"10.1109\/SP40000.2020.00036"},{"key":"ref41","doi-asserted-by":"publisher","DOI":"10.1109\/CGO53902.2022.9741274"},{"key":"ref22","first-page":"16","article-title":"Attacking smm memory via intel cpu cache poisoning","author":"wojtczuk","year":"2009","journal-title":"The Invisible Things Lab"},{"key":"ref44","doi-asserted-by":"publisher","DOI":"10.1145\/2666356.2594299"},{"key":"ref21","year":"2019","journal-title":"uefi org"},{"key":"ref43","doi-asserted-by":"publisher","DOI":"10.1145\/3183575"},{"key":"ref28","article-title":"Cryptorex: Large-scale analysis of cryptographic misuse in iot devices","author":"zhang","year":"2019","journal-title":"RAID"},{"key":"ref27","article-title":"Defeating signed bios enforcement","author":"kallenberg","year":"2013","journal-title":"EkoParty Buenos Aires"},{"key":"ref29","year":"0","journal-title":"RFC 4122"},{"key":"ref8","author":"lab","year":"2016","journal-title":"Smm unchecked pointer vulnerability"},{"key":"ref7","year":"2020","journal-title":"Through the smm-class and a vulnerability found there"},{"key":"ref9","doi-asserted-by":"publisher","DOI":"10.1145\/1966913.1966919"},{"key":"ref4","year":"2018","journal-title":"The lojax attack What you need to know"},{"key":"ref3","author":"oleksiuk\u201d","year":"2017","journal-title":"Thinkpwn"},{"key":"ref6","year":"2018","journal-title":"Code check (mate) in smm"},{"key":"ref5","author":"jarlstrom","year":"2020","journal-title":"A tour beyond bios secure smm communication in the efi developer kit ii"},{"key":"ref40","doi-asserted-by":"publisher","DOI":"10.1145\/3319535.3354244"}],"event":{"name":"2022 IEEE Symposium on Security and Privacy (SP)","location":"San Francisco, CA, USA","start":{"date-parts":[[2022,5,22]]},"end":{"date-parts":[[2022,5,26]]}},"container-title":["2022 IEEE Symposium on Security and Privacy (SP)"],"original-title":[],"link":[{"URL":"http:\/\/xplorestaging.ieee.org\/ielx7\/9833550\/9833558\/09833723.pdf?arnumber=9833723","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2023,11,8]],"date-time":"2023-11-08T23:13:38Z","timestamp":1699485218000},"score":1,"resource":{"primary":{"URL":"https:\/\/ieeexplore.ieee.org\/document\/9833723\/"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2022,5]]},"references-count":48,"URL":"https:\/\/doi.org\/10.1109\/sp46214.2022.9833723","relation":{},"subject":[],"published":{"date-parts":[[2022,5]]}}}