Intel patches new ME vulnerabilities • Hacker News Board

Re: Intel patches new ME vulnerabilities

#41

Post by exikyut » Sun, Jul 22, 2018, 2:09 PM UTC

nh2 wrote: post #2

Intel advisory: https://www.intel.com/content/www/us/en/security-center/advi... CVE-2018-3628 - "Buffer overflow in HTTP handler" Affected processor list (simplified reordered by me to reflect relevance and improve readability): • Core i3/i5/i7, generation 1-8 (that is, all of them) • Xeon E3-1200 v5/v6 • Xeon Scalable • Xeon W • Core 2 Duo vPro, Centrino 2 vPro

Wow.

The Web really has won.

We have HTTP parsing failures in our CPUs.

Re: Intel patches new ME vulnerabilities

#42

Post by bhouston » Sun, Jul 22, 2018, 2:12 PM UTC

coaxial wrote: post #12

NullPrefix wrote: post #10

Earlier quoted context omitted.

Grandpa, it's time to upgrade.

Why? Because it's been longer than intel would like since parent gave them money?

If Intel has made currently processes ultra fast recently that wouldn't be an issue, but the Intel Core i7 2700 is actually not that slow. Roughly comparable, at least within 20%, of other 4 core + 4 HT Intel processors.

Re: Intel patches new ME vulnerabilities

#43

Post by close04 » Sun, Jul 22, 2018, 2:12 PM UTC

brian_herman wrote: post #39

I finally pushed the button on my lenovo T450S there is a setting in the bios to delete the AMT. While the best route is to reprogram... I would just rather click one button and set bios passwords afterwards.

The ME (AMT) is never actually disabled or deleted as long as the FW is there and running.

Plus you should take advantage of the fact that the 450 is still supported and gets a ME FW update.

Yesterday I updated all my machines with Gen 4 CPU with new BIOS, new ME FW, and (surprisingly) new TPM FW. The Gen 3 CPU machines barely got a BIOS update for Metldown/Spectre and that's it.

Re: Intel patches new ME vulnerabilities

#44

Post by eutropia » Sun, Jul 22, 2018, 2:16 PM UTC

Is it possible to mitigate this by blocking traffic on the ports that the ME uses for communication at the router level?

Re: Intel patches new ME vulnerabilities

#45

Post by ksec » Sun, Jul 22, 2018, 2:18 PM UTC

ramshanker wrote: post #22

It looks like every 6 month some bad news for Intel.

At the moment it is looking like every 6 weeks. One more Reason why CEO was fired. ( So no one to blame )

Re: Intel patches new ME vulnerabilities

#46

Post by avuton » Sun, Jul 22, 2018, 2:18 PM UTC

close04 wrote: post #40

avuton wrote: post #15

Earlier quoted context omitted.

I'm oddly lucky that I based my fanless server off an old Atom platform.

"Luckily" most old Atoms will never get mitigations for Meltdown/Spectre :). So if you're using an Intel CPU today you'll just have to pick your poison.

I was under the impression that they weren't susceptible.

Re: Intel patches new ME vulnerabilities

#47

Post by thepumpkin1979 » Sun, Jul 22, 2018, 2:18 PM UTC

Can MacBook owners do something to disable or cripple Intel ME? Is Apple disabling it for us? I can’t find Apple responses to these issues.

Re: Intel patches new ME vulnerabilities

#48

Post by some_account » Sun, Jul 22, 2018, 2:18 PM UTC

nh2 wrote: post #2

Intel advisory: https://www.intel.com/content/www/us/en/security-center/advi... CVE-2018-3628 - "Buffer overflow in HTTP handler" Affected processor list (simplified reordered by me to reflect relevance and improve readability): • Core i3/i5/i7, generation 1-8 (that is, all of them) • Xeon E3-1200 v5/v6 • Xeon Scalable • Xeon W • Core 2 Duo vPro, Centrino 2 vPro

I guess I should not be surprised that the HN community doesn't really seem to care.

Intel put the Management Engine into every CPU with no choice from consumers to opt out. That alone is fairly surprising, since they knew it was a big chance it would have exploits and consumers would have no defense.

But nobody reacts. Nobody cares.

Re: Intel patches new ME vulnerabilities

#49

Post by nine_k » Sun, Jul 22, 2018, 2:19 PM UTC

close04 wrote: post #40

avuton wrote: post #15

Earlier quoted context omitted.

I'm oddly lucky that I based my fanless server off an old Atom platform.

"Luckily" most old Atoms will never get mitigations for Meltdown/Spectre :). So if you're using an Intel CPU today you'll just have to pick your poison.

Running only trusted code on a server is much simpler than on a desktop / laptop: no Javascript in browser.

Re: Intel patches new ME vulnerabilities

#50

Post by Filligree » Sun, Jul 22, 2018, 2:20 PM UTC

avuton wrote: post #15

nh2 wrote: post #2

Intel advisory: https://www.intel.com/content/www/us/en/security-center/advi... CVE-2018-3628 - "Buffer overflow in HTTP handler" Affected processor list (simplified reordered by me to reflect relevance and improve readability): • Core i3/i5/i7, generation 1-8 (that is, all of them) • Xeon E3-1200 v5/v6 • Xeon Scalable • Xeon W • Core 2 Duo vPro, Centrino 2 vPro

I'm oddly lucky that I based my fanless server off an old Atom platform.

AMD seems considerably more on top of the security game. As for ME, make sure you avoid any system on which it is enabled.