USENIX WOOT 2026 · systematization of knowledge
System Management Mode (SMM) runs beneath the OS and hypervisor with system-wide authority, which has long made it a target for attacks. This is the dataset from our SoK paper, made sortable and filterable, and updated as new work appears.
System Management Mode is a special x86 execution mode, present since the early 1990s, that operates outside the normal privilege hierarchy. It is often called “ring −2,” sitting below the OS kernel (ring 0) and the hypervisor (ring −1).
It is entered through a System Management Interrupt (SMI): the
processor transparently suspends whatever was running, saves its state, and jumps
to firmware-defined handler code executing from a protected memory region
(SMRAM). An RSM instruction resumes the interrupted
context. The whole transition is invisible to the OS and hypervisor.
SMM handles power management, thermal control, legacy device emulation, and security-critical firmware services (secure boot, authenticated variables, S3 resume). Because it has full hardware access and can preempt any context, it has been a target for stealthy rootkits and privilege-escalation attacks for over two decades.
RSMFull background in the SoK paper (§2, “Demystifying SMM”).
Every entry is labelled with the SoK's classification tree (paper Fig. 2), capturing where the weakness resides and what surface it exploits. Click any node below to filter the table by that category (click again to clear); selecting a parent matches everything beneath it.
How the offensive works split across the three eras — by classification category and by whether automated tooling was used to find them. Counts are computed live from the dataset.
If this index or the systematization behind it helps your work, please cite the SoK paper:
You can also reference the artifact and dataset through its Zenodo DOI.
No entries match the current filters.
Found a new attack, tool, or advisory? Entries live in a single
data.json file — the site's sole source of truth. Add an
object to its entries array (copy a nearby one and adjust), then
commit. The classification chips and filters update themselves from the
taxonomy you tag it with.