4 ms·

I prefer the wording in Lenovo's security advisory [0]: > "Potential Impact: An attacker could load and execute arbitrary code outside the visibility of the u

I prefer the wording in Lenovo's security advisory [0]: > "Potential Impact: An attacker could load and execute arbitrary code outside the visibility of the user, operating system, and hypervisor/virtualization platform; resulting in exfiltration of secrets, subtle manipulation of system operation, or denial of service." [0]: https://support.lenovo.com/us/en/product_security/len-17297 https://support.lenovo.com/us/en/product_security/len-17297

loop0 9y ago
It is nice to know lenovo already has the updates, but sadly I'm gonna have to install windows for that :(
- criddell 9y ago
  Send me your IP and I'll patch it for you.
  - kome 9y ago
    first "ahahaha" then "sigh..."
  - throwaway613834 9y ago
    Wouldn't really work behind a NAT...
    - abainbridge 9y ago
      Unless the NAT is running on an affected processor... (Which is unlikely if its a COTS dedicated router).
- deleted 9y ago
  [deleted]
- jlgaddis 9y ago
  Go for the "bootable CD" option, if it's available. You don't need Windows for that. My ThinkPads all run Linux and I have no problems updating them.
  - loop0 9y ago
    Thanks, I'm gonna look into that!
  - loop0 9y ago
    Unfortunately I couldn't find the bootable cd version for the intel management engine firmware and software updates. Mine is a thinkpad t460s.
  - morpheuskafka 9y ago
    I think that's only for BIOS updates, not ME. ME uses an Intel provided flash EXE. It would probably run on PE or definitely Windows to Go though.
    - jlgaddis 9y ago
      Ahhh, my bad, sorry!
    - lorenzhs 9y ago
      I figured out how to install it using Windows PE. First, get a Windows installer image or WADK and mount it. Microsoft provides these, but hides the download link well. Then get the ME firmware update installer and the AMT/ME software installer from Lenovo and execute the unpackers with wine. From ~/.wine/drive_c/DRIVERS/WIN/AMT, do "cabextract SetupME.exe". You can discard everything but the "HECI_REL" directory from this, including SetupME.exe. Now you need wimlib to create the WinPE image: "mkwinpeimg --windows-dir=/mnt winpe.img --overlay=$HOME/.wine/drive_c/DRIVERS" The resulting winpe.img can be dd'ed to a USB thumb drive. Boot into it, and execute "cd /WIN/AMT/HECI_REL/win10", "drvload HECI.inf" (to load the MEI driver) and then "cd /WIN/ME/", "MEUpdate.cmd" to update the ME firmware.
- orblivion 9y ago
  Seriously. After they pulled that from the last ME vulnerability they lost me as a customer.
- lorenzhs 9y ago
  You can create a Windows PE image which can be booted from a USB thumb drive, see my comment further down this thread: https://news.ycombinator.com/item?id=15744152 https://news.ycombinator.com/item?id=15744152
toomanybeersies 9y ago
Ironic, coming from the company that had superfish and its self-signed CA installed on its laptops from factory.
reirob 9y ago
Thanks for posting it. Strangely both the T450s and 25 (anniversary edition) are not listed at all?!

loop0 9y ago

It is nice to know lenovo already has the updates, but sadly I'm gonna have to install windows for that :(

criddell 9y ago
Send me your IP and I'll patch it for you.
- kome 9y ago
  first "ahahaha" then "sigh..."
- throwaway613834 9y ago
  Wouldn't really work behind a NAT...
  - abainbridge 9y ago
    Unless the NAT is running on an affected processor... (Which is unlikely if its a COTS dedicated router).
deleted 9y ago
[deleted]
jlgaddis 9y ago
Go for the "bootable CD" option, if it's available. You don't need Windows for that. My ThinkPads all run Linux and I have no problems updating them.
- loop0 9y ago
  Thanks, I'm gonna look into that!
- loop0 9y ago
  Unfortunately I couldn't find the bootable cd version for the intel management engine firmware and software updates. Mine is a thinkpad t460s.
- morpheuskafka 9y ago
  I think that's only for BIOS updates, not ME. ME uses an Intel provided flash EXE. It would probably run on PE or definitely Windows to Go though.
  - jlgaddis 9y ago
    Ahhh, my bad, sorry!
  - lorenzhs 9y ago
    I figured out how to install it using Windows PE. First, get a Windows installer image or WADK and mount it. Microsoft provides these, but hides the download link well. Then get the ME firmware update installer and the AMT/ME software installer from Lenovo and execute the unpackers with wine. From ~/.wine/drive_c/DRIVERS/WIN/AMT, do "cabextract SetupME.exe". You can discard everything but the "HECI_REL" directory from this, including SetupME.exe. Now you need wimlib to create the WinPE image: "mkwinpeimg --windows-dir=/mnt winpe.img --overlay=$HOME/.wine/drive_c/DRIVERS" The resulting winpe.img can be dd'ed to a USB thumb drive. Boot into it, and execute "cd /WIN/AMT/HECI_REL/win10", "drvload HECI.inf" (to load the MEI driver) and then "cd /WIN/ME/", "MEUpdate.cmd" to update the ME firmware.
orblivion 9y ago
Seriously. After they pulled that from the last ME vulnerability they lost me as a customer.
lorenzhs 9y ago
You can create a Windows PE image which can be booted from a USB thumb drive, see my comment further down this thread: https://news.ycombinator.com/item?id=15744152 https://news.ycombinator.com/item?id=15744152

toomanybeersies 9y ago

Ironic, coming from the company that had superfish and its self-signed CA installed on its laptops from factory.

reirob 9y ago

Thanks for posting it. Strangely both the T450s and 25 (anniversary edition) are not listed at all?!