Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

ThinkPwn: System Management Mode arbitrary code execution

github.com

Post reply on HN
Print view View original

41–50 of 154 posts

Re: ThinkPwn: System Management Mode arbitrary code execution

#41

Post by ff10 »

jkldotio wrote: post #9

What are we up to now? Three preloaded spyware scandals, possible remote execution via the Intel stack and now this vulnerability. That's just what we know about, who knows what else exists. I don't think I can buy another one, which is sad as I think it was a timeless and great design.

I own a couple of Apple notebooks. Two years ago I bought a used X201 because I needed a Linux backup (official excuse) and because I love the design (actual reason). It's completely different from Apple's approach and Richard Sapper's original draft is still visible in those machines. And it runs Ubuntu just fine with an SSD upgrade and still enough memory for all purposes I have.

Re: ThinkPwn: System Management Mode arbitrary code execution

#42

Post by dandelion_lover »

jMyles wrote: post #38
quotemstr wrote: post #34

I wish we could even purchase machines without SMM, Intel Management Engine, and similar features. On any machine I own, I want the CPU and the software running in ring zero to be the last word on what happens. I don't think it's unreasonable to ask for a system that meets this requirement.

Seriously. We need a group to examine and certify on this basis. This is getting out of hand.

> a group to examine and certify

Like FSF [0]?

[0] https://fsf.org/ryf

Re: ThinkPwn: System Management Mode arbitrary code execution

#43

Post by quotemstr »

dandelion_lover wrote: post #39
quotemstr wrote: post #34

I wish we could even purchase machines without SMM, Intel Management Engine, and similar features. On any machine I own, I want the CPU and the software running in ring zero to be the last word on what happens. I don't think it's unreasonable to ask for a system that meets this requirement.

As I commented elsewhere, we can, see https://news.ycombinator.com/item?id=12037410

That's good to hear. Thanks!

Re: ThinkPwn: System Management Mode arbitrary code execution

#44

Post by mindslight »

cdubzzz wrote: post #4

Interesting bit form Lenovo's security advisory on the matter[0]: > Shortly after the researcher stated over social media that he would disclose a BIOS-level vulnerability in Lenovo products, Lenovo PSIRT made several unsuccessful attempts to collaborate with the researcher in advance of his publication of this information. [0] https://support.lenovo.com/us/en/solutions/LEN-8324

It appears that the only security being broken is that of manufacturers against owners of machines. Why should a security researcher feel the least bit obligated to collaborate?

Re: ThinkPwn: System Management Mode arbitrary code execution

#45

Post by loeg »

OneTwoFree wrote: post #40

I thought I have an intermediate level C knowledge, but I have no idea what is happening in the vulnerable line: *(v3 + 0x8)(*(VOID **)v3, &dword_AD002290, CommunicationBuffer + 0x18); As I understand it is (was) an example code from Intel. Example codes should be easy to understand and well documented.

It's C generated by disassembling x86 assembler code. It is not an example code from Intel.

The function pointer at `v3 + 0x8` is invoked with arguments: (1) the pointer at `v3 + 0x0`, (2) some fixed pointer, and (3) a pointer into the CommunicationBuffer.

E.g. here's more idiomatic C code to represent the same idea:

    struct Thunk {
      void *argument;
      void (fp)(void *, DWORD *, void *);
    };
    struct CommunicationBuffer {
      uint64_t unknown[4];
      struct Thunk *thunk;
      ...;
    };

    EFI_STATUS __fastcall sub_AD3AFA54(
        EFI_HANDLE SmmImageHandle, VOID *CommunicationBuffer, UINTN *SourceSize)
    {
      struct CommunicationBuffer *cb = CommunicationBuffer;
      if (cb->thunk) {
        cb->thunk->fp(cb->thunk->argument, &dword, &cb->unknown[3]);
        cb->thunk = NULL;
      }
      return 0;
    }

Re: ThinkPwn: System Management Mode arbitrary code execution

#46

Post by [deleted] »

OneTwoFree wrote: post #40

I thought I have an intermediate level C knowledge, but I have no idea what is happening in the vulnerable line: *(v3 + 0x8)(*(VOID **)v3, &dword_AD002290, CommunicationBuffer + 0x18); As I understand it is (was) an example code from Intel. Example codes should be easy to understand and well documented.

[deleted]

Re: ThinkPwn: System Management Mode arbitrary code execution

#47

Post by fencepost »

Don't just plaster Lenovo with this - they're getting the splatter because Cr4sh has been researching their firmware, but this is a multi-vendor issue.

A few important notes from the article and the releaser's blog post:

* This is not a Lenovo problem so much as a problem for multiple vendors who used BIOS based on Intel's reference information. The original problem was with source code provided by Intel. The same problem is confirmed to exist in at least one HP system.

* This was apparently fixed back in 2014, but there doesn't seem to be an indication that it was recognized as a security flaw then or at least it wasn't noted as a security fix. 2014 isn't that long ago in terms of propagating BIOS updates.

* Cr4sh apparently decided to just release, "I decided to do the full disclosure because the main goal of my UEFI series articles is to share the knowledge, not to make vendors and their users happy."

* His assessment is "It’s very unlikely that this vulnerability will be exploited in the wild, for regular customers there are much more chances to be killed with the lightning strike than meet any System Management Mode exploit or malware."

Re: ThinkPwn: System Management Mode arbitrary code execution

#48

Post by CaptSpify »

snuxoll wrote: post #21
geocar wrote: post #14

Earlier quoted context omitted.

Clear as mud. Lenovo has previously sacrificed user security and privacy for money (superfish), so it does not surprise me that they have done it again, and these kinds of weasel words aren't going to get me to buy another Lenovo product again. Here's an idea: How about not putting backdoors in our products? How about making it easier for consumers to replace software on systems they own?

Lenovo has always maintained a higher standard for their Think products, Superfish was only an issue on the Idea line. Doesn't excuse the debacle, but ThinkPad's are their professional line of notebooks and they make every effort to keep a positive image.

Ehhh..... that used to be the case. As an owner of 2 thinkpads, I'm not convinced thats still true

Re: ThinkPwn: System Management Mode arbitrary code execution

#49

Post by JonathonW »

dandelion_lover wrote: post #35
jkldotio wrote: post #9

What are we up to now? Three preloaded spyware scandals, possible remote execution via the Intel stack and now this vulnerability. That's just what we know about, who knows what else exists. I don't think I can buy another one, which is sad as I think it was a timeless and great design.

> What are we up to now? I am about to buy and advice to others the only freedom-respecting laptops [0]. [0] https://minifree.org/product/libreboot-t400/ and https://minifree.org/product/libreboot-x200/

AKA refurbished Lenovo hardware?

Re: ThinkPwn: System Management Mode arbitrary code execution

#50

Post by Nadya »

retox wrote: post #36
ssebastianj wrote: post #27

Earlier quoted context omitted.

The author (Dmytro Oleksiuk) tweeted [0]: 'Dear vendors, “give us your 0day vulnerability for free and don’t publish anything” — it’s not a cooperation request'. [0] https://twitter.com/d_olex/status/748806692754714625

So he's holding them to random?

Not by the looks of it.

> I agreed to do that, but they haven't accepted my terms and conditions (just for case -- I haven't asked them about money)

Post reply on HN