System Management Mode, or SMM, is a very privileged CPU mode used by firmware for low-level tasks such as power management, thermal control, and platform management. When the processor enters SMM, it runs in a protected environment that is separate from the normal operating system and many hypervisor controls.
SMM matters because code running there can read or modify sensitive hardware state and memory, often with more authority than the kernel. If SMM code is flawed, attackers may be able to bypass operating-system defenses, hide activity, or weaken memory protections. Defenders therefore treat SMM as part of the trusted computing base and keep it as small and well-audited as possible.
In real security work, SMM appears in firmware hardening, BIOS updates, and research into privilege-escalation bugs or memory-isolation failures. Auditors look for unsafe SMM handlers, weak input validation, and improper access to system memory, because mistakes at this layer can undermine protections that look strong at the software layer.