Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

ThinkPwn: System Management Mode arbitrary code execution

github.com

Post reply on HN
Print view View original

31–40 of 154 posts

Re: ThinkPwn: System Management Mode arbitrary code execution

#31

Post by cdubzzz »

ssebastianj wrote: post #27
jkot wrote: post #19

Earlier quoted context omitted.

Maybe author did not want to deal with Lenovo. > Lenovo did not develop the vulnerable SMM code and is still in the process of determining the identity of the original author, it does not know its originally intended purpose.

The author (Dmytro Oleksiuk) tweeted [0]: 'Dear vendors, “give us your 0day vulnerability for free and don’t publish anything” — it’s not a cooperation request'. [0] https://twitter.com/d_olex/status/748806692754714625

Thanks for pointing that out. Glad to see in the thread that he is also planning to post information about what his requested terms were.

Re: ThinkPwn: System Management Mode arbitrary code execution

#32

Post by jsjohns2 »

Quite the hilarious "security advisory" [0] that Lenovo put out. They manage to take zero responsibility, shift blame to the researcher/IBV/Intel, and admit that they ship SMM code of both unknown author and purpose.

[0] https://support.lenovo.com/us/en/solutions/LEN-8324

Re: ThinkPwn: System Management Mode arbitrary code execution

#34

Post by quotemstr »

I wish we could even purchase machines without SMM, Intel Management Engine, and similar features. On any machine I own, I want the CPU and the software running in ring zero to be the last word on what happens. I don't think it's unreasonable to ask for a system that meets this requirement.

Re: ThinkPwn: System Management Mode arbitrary code execution

#35

Post by dandelion_lover »

jkldotio wrote: post #9

What are we up to now? Three preloaded spyware scandals, possible remote execution via the Intel stack and now this vulnerability. That's just what we know about, who knows what else exists. I don't think I can buy another one, which is sad as I think it was a timeless and great design.

> What are we up to now?

I am about to buy and advice to others the only freedom-respecting laptops [0].

[0] https://minifree.org/product/libreboot-t400/ and https://minifree.org/product/libreboot-x200/

Re: ThinkPwn: System Management Mode arbitrary code execution

#36

Post by retox »

ssebastianj wrote: post #27
jkot wrote: post #19

Earlier quoted context omitted.

Maybe author did not want to deal with Lenovo. > Lenovo did not develop the vulnerable SMM code and is still in the process of determining the identity of the original author, it does not know its originally intended purpose.

The author (Dmytro Oleksiuk) tweeted [0]: 'Dear vendors, “give us your 0day vulnerability for free and don’t publish anything” — it’s not a cooperation request'. [0] https://twitter.com/d_olex/status/748806692754714625

So he's holding them to random?

Re: ThinkPwn: System Management Mode arbitrary code execution

#37

Post by mindslight »

excelangue wrote: post #3

Starting with the X230 series of ThinkPads, Lenovo has used flash write protection to prevent "unauthorized" BIOS modifications. Owners of X220 laptops and below are able to reflash the BIOS to remove Lenovo's whitelist of WLAN/WWAN cards; the X230 models are currently stuck with Wi-Fi N and Gobi 3000 3G-only cards due to Lenovo's whitelist. Would this exploit allow ThinkPad owners to reflash their BIOS chip without…

The Sierra cards seem to have the explicit ability to change the USB ID (this is how they signal the OS to use serial or newer packed based drivers), so I would think you could easily use a newer card with the USB ID set to one of the old ones? I have not tested this yet.

Re: ThinkPwn: System Management Mode arbitrary code execution

#38

Post by jMyles »

quotemstr wrote: post #34

I wish we could even purchase machines without SMM, Intel Management Engine, and similar features. On any machine I own, I want the CPU and the software running in ring zero to be the last word on what happens. I don't think it's unreasonable to ask for a system that meets this requirement.

Seriously. We need a group to examine and certify on this basis. This is getting out of hand.

Re: ThinkPwn: System Management Mode arbitrary code execution

#39

Post by dandelion_lover »

quotemstr wrote: post #34

I wish we could even purchase machines without SMM, Intel Management Engine, and similar features. On any machine I own, I want the CPU and the software running in ring zero to be the last word on what happens. I don't think it's unreasonable to ask for a system that meets this requirement.

As I commented elsewhere, we can, see https://news.ycombinator.com/item?id=12037410

Re: ThinkPwn: System Management Mode arbitrary code execution

#40

Post by OneTwoFree »

I thought I have an intermediate level C knowledge, but I have no idea what is happening in the vulnerable line:

    *(v3 + 0x8)(*(VOID **)v3, &dword_AD002290, CommunicationBuffer + 0x18);
As I understand it is (was) an example code from Intel. Example codes should be easy to understand and well documented.
Post reply on HN