6 ms·
Thankfully this doesn't look quite as serious as the SemiAccurate article earlier today made it look (it's AMT, not ME), and doesn't affect consumer CPUs. But i
by lorenzhs 10y ago
Thankfully this doesn't look quite as serious as the SemiAccurate article earlier today made it look (it's AMT, not ME), and doesn't affect consumer CPUs. But if you have AMT provisioned, then holy cow this is really really bad. Remotely exploitable is just wow.
- jacquesm 10y agoIt's bad enough. And SemiAccurate did live up to its name.
- lorenzhs 10y agoAgreed, it's still very bad. I don't want to imagine how many company PCs are affected by this, and which percentage of those is going to get the firmware update.
- nobodyorother 10y agoInterestingly, they got the versions right, if not the feature (AMT vs ME).
- deleted 10y ago[deleted]
- kuschku 10y agoApparently, systems with vPRO functionality are also affected, which would include almost all Xeons[1], and many of the upper range consumer chips. If that's the case, this might really become huge. [1] http://ark.intel.com/Search/FeatureFilter?productType=processors&VProTechnology=true http://ark.intel.com/Search/FeatureFilter?productType=proces...
- jacquesm 10y agoVPro is not in all Xeons, AMT is in only two Xeons that I've been able to find so far, 3400 and E3-1200.
- kuschku 10y agoIntel ARK disagrees with you: http://ark.intel.com/Search/FeatureFilter?productType=processors&VProTechnology=true http://ark.intel.com/Search/FeatureFilter?productType=proces...
- jacquesm 10y agoNo, it does not. Again: VPro is not in all Xeons (though it is in many of them, and it is in most or all of the current product line), AMT is in only very few Xeons. If VPro were in all Xeons then each and every Intel based computer in a DC would be affected. And that's clearly not the case. Also, it is not yet clear - at least to me - whether or not VPro is affected at all but if the ME runs AMT then it definitely is affected.
- kuschku 10y agoEvery Xeon I’ve ever used is in that list, as is every other Intel CPU I’ve ever used. It’s quite an extensive list, and definitely not "only 2"
- jacquesm 10y agoThe 'only 2' are about which Xeons I've found that definitely run AMT. That's something else. Intel isn't helping with their marketing spaghetti, but you're also not helping by suggesting that each and every Xeon is affected. Though if that is the case Intel has a much more serious problem on its hand for suggesting that only business desktops and a couple of low end servers are affected.
- kevin_b_er 10y agohttps://software.intel.com/en-us/blogs/2011/12/14/intelr-amt-and-the-intelr-me https://software.intel.com/en-us/blogs/2011/12/14/intelr-amt... AMT is run in the management engine. "The Intel AMT functionality is contained in the ME firmware (Manageability Engine Firmware)." So, yes, it's the ME that was exploited. AMT is just an app for the ME.
- pepve 10y agoWell, if there is a vulnerability for Nginx on Linux, you wouldn't say Linux had a vulnerability right? I think this situation might be similar.
- jacquesm 10y agoNo, that's not the same. Imagine ME being exploited, that would open up the system regardless of whether or not you even had AMT, installed or enabled. That would be a far more serious issue, the number of systems affected would be a very large multiple of the number of systems affected by this bug.