Intel Hardware allows activation of test or debug logic at runtime

https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00528.html

by _tk_ • 5 years ago

101 30 5 years ago

mook• 5 years ago

Looks like (according to Intel) it's only the lower end Pentium / Celeron / Atom stuff; it wouldn't be useful for the kinds of chips people are most interested in circumventing ME for, though perhaps there are things that are useful to learn…

Also mildly interesting, Dmitry Sklyarov was credited… appears to be the same one from Elcomsoft that got arrested at one point because Adobe complained (and DMCA).

tyingq• 5 years ago

Also seems to require physical access:

"may allow an unauthenticated user to potentially enable escalation of privilege via physical access"

I'm sure there's cases where that's still an issue, but for me, if they have their hands on it it's probably game over via some other route.

zsmi• 5 years ago

The CVE is reserved at this time so it's hard to be sure. http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-0146

They're not impenetrable per se, but iPhone is pretty secure, even with physical access.

kcb• 5 years ago

The Atom SoCs in question were widely used in network switches and appliances.

jeffbee• 5 years ago

Atom is not a low-end product. Atom is to Intel’s embedded product line what Xeon is to their server and workstation line. It’s the top brand.

nicolaslem2• 5 years ago

There is also a whole series of Atom processor made for 5G telecom appliances, the kind of thing where security definitely matters.

The Atom C3000 series is also widely used in NAS because it supports ECC memory and can be passively cooled while still being performant enough to not be a bottleneck.

SavantIdiot• 5 years ago

Uh oh, looks like someone left the DF* (DF-star, a.k.a. design for X) features accessible and not fused-off. The links on the intel page don't show any details, nor does googling the CVE.

vbitz• 5 years ago

One of the researchers (@_markel___) put out a tweet with more information

After a year of the coordinated disclosure process, we (+ @h0t_max and @_Dmit ) can finally share: we found a reliable, not damaging way to extract the security fuses (Chipset + EPID root keys) from the Intel platforms.

https://twitter.com/_markel___/status/1458147735270481926

userbinator4• 5 years ago

coordinated disclosure

I wonder if these people really think they are heroes for effectively helping Intel further its user-hostile actions.

rbanffy2• 5 years ago

The Atom C3000 family is really cursed, it seems.

frankharv• 5 years ago

Worse than the C2xxx family? Intel has a trust deficit.

https://www.theregister.com/2017/02/07/intel_atom_failures_g...

rbanffy2• 5 years ago

"C" stands for "cursed".

sjburt• 5 years ago

Intel recommends that users of affected Intel® Processors update to the latest version provided by the system manufacturer that addresses these issues.

The latest version of what? microcode? BIOS?

3np• 5 years ago

Sounds like the processor/SoC itself?

marcodiego• 5 years ago

Does this help circumvent/disable IME?

userbinator4• 5 years ago

"may allow escalation of privilege" - from being a mere consumer to an actual owner? All advantages as far as I can see, but of course to the authoritarian corporatocracy it's a vulnerability...

I really miss the days when Intel basically released all the documentation you needed to build a computer around their CPUs. The Pentium was when they started being secretive.

geofft• 5 years ago

You're not an "actual owner" if non-ring-0 code you run on your processor can gain ring 0.

I agree that there is value in having control over your devices. But control, by its nature, must be limited. If everyone controls your device, nobody does, certainly not you.

userbinator4• 5 years ago

This seems to be about physical access, not ring-3.

weare138• 5 years ago

But it's proprietary security through obscurity which is why this keeps happening.

maffle• 5 years ago

Just noticed mostly all laptops got a bios update today, including Dell and HP.

https://support.hp.com/us-en/document/ish_5031100-5031212-16...

Whats going on? These arent to Atom CPUs alone it seems.

Intel Hardware allows activation of test or debug logic at runtime

Related Stories