Summary: An Intel CPU in "Red Unlock" mode allows any user-mode code to read and write its microcode. The paper teaches security researchers how to do it. They can use it to discover undocumented Intel CPU internals and functionality.
I don't know if these instructions will be useful in exploits. They require the CPU to be in Red Unlock mode. One known way to enable Red Unlock requires connecting a special cable to the motherboard's USB port and exploiting the Intel Trusted Execution Engine core [0].
There are probably remote exploits via ethernet and the Intel Management Engine.
Could there be some motherboards that shipped with Red Unlock mode permanently enabled? User-mode code running on such machines could trivially root the machine and even escape a hypervisor.
Tool : https://github.com/chip-red-pill/udbgInstr
Undocumented x86 insts for uarch control : https://github.com/chip-red-pill/udbgInstr/blob/main/paper/u...