Intel Identifies Security Vulnerabilites: ME, SPS, TXE

Topic

New Reply

Intel Q3’17 ME 11.x, SPS 4.0, and TXE 3.0 Security Review Cumulative Update
https://security-center.intel.com/advisory.aspx?intelid=INTEL-SA-00086&languageid=en-fr

Intel ID: INTEL-SA-00086
Product family: Various
Impact of vulnerability: Elevation of Privilege
Severity rating: Important
Original release: Nov 20, 2017
Last revised: Nov 20, 2017

 
Description:
In response to issues identified by external researchers, Intel has performed an in-depth comprehensive security review of its Intel® Management Engine (ME), Intel® Trusted Execution Engine (TXE), and Intel® Server Platform Services (SPS) with the objective of enhancing firmware resilience.

As a result, Intel has identified several security vulnerabilities that could potentially place impacted platforms at risk. Systems using ME Firmware versions 11.0/11.5/11.6/11.7/11.10/11.20, SPS Firmware version 4.0, and TXE version 3.0 are impacted.

Affected products:
6th, 7th & 8th Generation Intel® Core™ Processor Family
Intel® Xeon® Processor E3-1200 v5 & v6 Product Family
Intel® Xeon® Processor Scalable Family
Intel® Xeon® Processor W Family
Intel® Atom® C3000 Processor Family
Apollo Lake Intel® Atom Processor E3900 series
Apollo Lake Intel® Pentium™
Celeron™ N and J series Processors

Based on the items identified through the comprehensive security review, an attacker could gain unauthorized access to platform, Intel® ME feature, and 3rd party secrets protected by the Intel® Management Engine (ME), Intel® Server Platform Service (SPS), or Intel® Trusted Execution Engine (TXE).

This includes scenarios where a successful attacker could:
Impersonate the ME/SPS/TXE, thereby impacting local security feature attestation validity.
Load and execute arbitrary code outside the visibility of the user and operating system.
Cause a system crash or system instability.
For more information, please see this Intel Support article

Intel® Manageability Engine Firmware 11.0.x.x/11.5.x.x/11.6.x.x/11.7.x.x/11.10.x.x/11.20.x.x
Intel Manageability Engine Firmware 8.x/9.x/10.x*
Server Platform Service 4.0.x.x
Intel Trusted Execution Engine 3.0.x.x

Intel has released a downloadable detection tool located at http://www.intel.com/sa-00086-support, which will analyze your system for the vulnerabilities identified in this security advisory.

Intel highly recommends checking with your system OEM for updated firmware. Links to system manufacturer pages concerning this issue can be found at http://www.intel.com/sa-00086-support

Intel highly recommends that all customers install the updated firmware and Intel® Capability License Service on impacted platforms.

 
theregister.co.uk have a write-up:

Intel finds critical holes in secret Management Engine hidden in tons of desktop, server chipsets
Bugs can be exploited to extract info, potentially insert rootkits
By Thomas Claburn in San Francisco 20 Nov 2017

 
Related AskWoody topics:
The earlier Intel ME topic (May 2017) & follow-up (August 2017)

2 users thanked author for this post.

Fred, AJNorth

Reply | Quote

Replies

Intel ME/AMT is mostly found in high-end Wintel Business PCs and is enabled by default. Home-users who have bought such refurbished computers cheaply will be affected. Here is how to disable Intel ME/AMT …
https://software.intel.com/en-us/forums/intel-business-client-software-development/topic/563988

Also, to be sure, unplug such desktop computers from the AC wall outlet when not in use or remove the battery from the laptop when not in use.

These preventive steps are in addition to the OP’s BIOS firmware update mitigation.

Reply | Quote

Interesting, didn’t know that Linux doesn’t run on Intel chips.. lol

Reply | Quote

The detection tool has a Linux version, as well as the Windows tool (see link above)

Reply | Quote

Intel Fixes Critical Bugs in Management Engine, Its Secret CPU-On-Chip
By Catalin Cimpanu | November 21, 2017

 
The vulnerabilities are severe enough to allow attackers to install rootkits on vulnerable PCs, retrieve data processed inside CPUs, and cause PC crashes —which should be the least of someone’s worries.

One of the affected products is the Intel Management Engine, a technology that is often described as a secret CPU inside the main Intel CPU. The ME component runs independently from the user’s main OS, with separate processes, threads, memory manager, hardware bus driver, file system, and many other components. An attacker that exploits a flaw and gains control over the Intel ME has untethered control over the entire computer.

The CPU maker has released firmware updates to address these flaws. The updates are not available to the general public, as chipset and motherboard vendors will have to integrate the updates into their own updates. Lenovo has already issued patches for some products that are using vulnerable Intel ME, SPS, or TXE technologies.

 
Read the full article here

1 user thanked author for this post.

Elly

Reply | Quote

Happy US Thanksgiving!

I just did a BIOS Flash for my Intel NUC from a download of the new BIOS Update from Intel. One method (direct F7) failed completely. So I downloaded another method, and used the F2 BIOS console. There the BIOS found and recognized the .bio update file and ran it. The Detection Tool now says I am no longer vulnerable. Mission Accomplished! Happy US Thanksgiving to all! ?

My tablet uses its own ASUS SoC Firmware, and is not on this list. So it would not be vulnerable. And there is no BIOS or SoC Firmware update for the tablet. No detection tool for that tablet either — at least not one which works on that hardware.

-- rc primak

Reply | Quote

so for those of us who don’t get under the hood with the hardware too often, is the best action plan to download and run the detection tool that Intel released and let it check and see if any of this even applies to our machine(s), then move ahead accordingly?

Reply | Quote

That sounds like the best way to go. Use the detection tool and if it doesn’t apply to your computer, you have nothing to worry about.

1 user thanked author for this post.

rc primak

Reply | Quote

And if it does apply to your system, try to use your BIOS Access Page (mine is found with F2 during boot) and update from there. You will need to download the .bio file from Intel’s site, and store it in a drive or partition which can be read directly from the BIOS (not all Flash Drives qualify).That’s the safest method.

-- rc primak

Reply | Quote

Would a system running an Intel Pentium E2180 Dual-Core be able to be affected by this? Or is that model of processor too old?

Reply | Quote

No, it is not affected.  Yours is a Legacy processor.

the information is on Intel’s website.

Reply | Quote

Thank you @PKCano, I actually found the page you linked not 2 minutes after posting my question. Again thank you for the quick response

Reply | Quote