Announcement

Collapse
No announcement yet.

BIOS Updates Begin Appearing For New Intel Privilege Escalation Vulnerabilities

Collapse
X
 
  • Filter
  • Time
  • Show
Clear All
new posts
    arQon
    Senior Member

  • arQon
    replied
    Originally posted by linner View Post
    This is really frustrating with my 8+ year-old motherboards that probably won't get an update or if they do it's years late.
    8+ years?! I'd be surprised to see a BIOS update for anything more than *3* years old, 5 at the absolute extreme. (And the 5 is for server hardware, MAYBE). The margins on consumer-grade gear are so thin that, like phones, anything over even just 18 months or so counts as "good" - and the only thing that changes after the first 6 months or so is updates for RAM compatibility etc, not anything substantive.

    AMD boards probably do slightly better in that regard, since AMD are capable of designing a socket that actually lasts more than a single generation. For Intel gear though, the constant required churn of new boards for every new CPU means only the most recent product line gets any support, even for screwups like total remote compromise via the IME etc.

    Leave a comment:

  • Alex/AT
    Senior Member

  • Alex/AT
    replied
    Originally posted by Vistaus View Post
    That's because AMD never makes mistakes when it comes to designing CPU's.
    As if. Half-modular FX was one crazy mistake by itself.
    Although I perfectly sit myself out on it till Zen came.

    The thing that they did not cheat out on validating memory accesses PL in speculative path ("Meltdown" source) to shave memory access latency came out as a pleasant surprise though indeed.
    Alex/AT
    Senior Member
    Last edited by Alex/AT; 12 November 2021, 02:04 PM.

    Leave a comment:

  • Vistaus
    Senior Member

  • Vistaus
    replied
    Originally posted by Alex/AT View Post
    Reading AMD list I don't see any vulnerability that is possible to exploit without attaining root privileges on system hypervisor or booted OS first, so their impact is limited to those who actively use hardware-assisted DRM and enclaves (an absolute minority).
    That's because AMD never makes mistakes when it comes to designing CPU's.

    Leave a comment:

  • Azrael5
    Senior Member

  • Azrael5
    replied
    Problem is that few companies support Bios updates via LVFS/FWUPD and for few of their items. A way to directly inoculate the patch into the BIOS should be applied, if it possible, in order to implement it to all the general BIOSes.
    Azrael5
    Senior Member
    Last edited by Azrael5; 08 December 2021, 06:26 AM.

    Leave a comment:

  • Azrael5
    Senior Member

  • Azrael5
    replied
    Intel is a menace for hardware users. It's an hardware malware.

    Leave a comment:

  • Alex/AT
    Senior Member

  • Alex/AT
    replied
    Originally posted by tunnelblick View Post
    Just as AMD also announced that you also need BIOS updates for Epyc CPUs:
    https://www.amd.com/en/corporate/pro...in/amd-sb-1021
    Reading AMD list I don't see any vulnerability that is possible to exploit without attaining root privileges on system hypervisor or booted OS first, so their impact is limited to those who actively use hardware-assisted DRM and enclaves (an absolute minority).

    BUT.

    This again warns us that 'system management processors' which are 'designed for better security' are actually having very low testing levels and so are huge security hole and need to be reconsidered as of to being implemented at all, they make parts of the system core uncontrollable by the end user, potentially resulting in a worldwide havoc if something more critical in them like remotely accessible backdoor is discovered and exposed.
    Alex/AT
    Senior Member
    Last edited by Alex/AT; 12 November 2021, 03:04 AM.

    Leave a comment:

  • skeevy420
    Senior Member

  • skeevy420
    replied
    Originally posted by CTTY View Post
    What privileges are needed to execute this attack?
    Just the white kind. Only a white guy with too much free time could learn to do these kinds of attacks.

    What does 'local user access' mean? I dont think physical access, since server are at risk, but is e.g. JavaScript in the Browser enough local user?
    I think it means anything from remote users to physical access. Possibly that could mean JavaScript in the browser, but I assume that would require this attack to be used in conjunction with a browser vulnerability.

    Leave a comment:

  • linner
    Senior Member

  • linner
    replied
    This is really frustrating with my 8+ year-old motherboards that probably won't get an update or if they do it's years late. Buying new hardware these days is just impractical for numerous reasons so that's not going to happen. Who wants to buy yet more buggy hardware at absurd prices? Maybe some day manufacturers will get their act together and it will be worthwhile to buy their hardware. Until then we're left with an insecure mess; and the government wonders why everyone keeps getting hacked.

    Leave a comment:

  • PluMGMK
    Senior Member

  • PluMGMK
    replied
    Yeah, I'm really struggling to understand what this is about… Is this possible while the OS is running?

    Leave a comment:

  • tunnelblick
    Junior Member

  • tunnelblick
    replied
    Just as AMD also announced that you also need BIOS updates for Epyc CPUs:
    https://www.amd.com/en/corporate/pro...in/amd-sb-1021

    Leave a comment:

Working...
X