7 ms·

Intel advisory: https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00112.html https://www.intel.com/content/www/us/en/security-center/adv

by nh2 8y ago

Intel advisory: https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00112.html https://www.intel.com/content/www/us/en/security-center/advi... CVE-2018-3628 - "Buffer overflow in HTTP handler" Affected processor list (simplified reordered by me to reflect relevance and improve readability): • Core i3/i5/i7, generation 1-8 (that is, all of them) • Xeon E3-1200 v5/v6 • Xeon Scalable • Xeon W • Core 2 Duo vPro, Centrino 2 vPro

geggam 8y ago
Every time I am about to upgrade this happens. cpu0: Intel(R) Pentium(R) D CPU 3.00GHz, 2993.01 MHz
- philjohn 8y ago
  Grab an AMD Ryzen then - you can disable most of the PSP (their ME) via a BIOS setting, and even then, it doesn't do half of the scary stuff ME does.
Macha 8y ago
Also worth noting that they're not patching it for 1st, 2nd or 3rd generation Core CPUs. I'm sure there's plenty of Sandy Bridge/Ivy Bridge CPUs in the wild, and it's not like you have an option to discontinue use of the Intel ME :(
- nebulous1 8y ago
  My i7-2600 is still a beast (well, still gong strong anyway). They did the same thing with Meltdown/Spectre fixes.
  - NullPrefix 8y ago
    Grandpa, it's time to upgrade.
    - coaxial 8y ago
      Why? Because it's been longer than intel would like since parent gave them money?
      - bhouston 8y ago
        If Intel has made currently processes ultra fast recently that wouldn't be an issue, but the Intel Core i7 2700 is actually not that slow. Roughly comparable, at least within 20%, of other 4 core + 4 HT Intel processors.
    - PostOnce 8y ago
      with an entry-level GPU and slow RAM that works with an i5-2500k, i can play every modern game i have tried on high. Nothing about me opening a text editor, interpreting most code, or compiling the occasional thing require anywhere near that much power. For the overwhelming majority, and i really mean overwhelming, there's really no progress or point to upgrading anything except the gpu in the past 7 years or so in laptops, new stuff uses a LOT less power for the same speed, so there's that I guess.
      - opencl 8y ago
        I upgraded my 2500k last year (to a Ryzen system) and the extra cores are very nice sometimes but honestly the biggest improvement was the fact that I also went from 8GB RAM to 16GB. There were a couple of games that benefited substantially from faster memory (Rise of the Tomb Raider, Fallout 4) but generally not so much the actual CPU performance.
    - deleted 8y ago
      [deleted]
    - deleted 8y ago
      [deleted]
- NullPrefix 8y ago
  No real advancement after Sandy Bridge was made. Only incremental 10% with each gen. That means current gen is only 2x as fast when comparing the same lines (i7 to i7). If you can't make new things better, just gimp the old ones, like Spectre/Meltdown.
  - close04 8y ago
    2 times faster would be quite good actually. Sadly we're barely at 50% faster per core, and that's including the usual 20-30% frequency bump on newer models. Pure IPC improvement is even lower, at maybe 2-5% per generation (~30% total at same frequency, 2nd gen vs. 7th gen). Yeah, you could argue that doubling the core or thread count doubled performance in selected software but the reality is that for real world use, excluding specific corner cases, the improvement is hard to notice. A reason to upgrade is to have a newer platform and the features that would bring, definitely not the CPU.
  - merb 8y ago
    well ddr4 is a huge improvement
    - Dylan16807 8y ago
      If you're memory-starved, yes. A typical quad core is not going to be memory-starved, and the effect is pretty mild compared to the effect of a GPU. Or for non-gaming, it either doesn't matter at all or is 90% about core count. https://img.purch.com/r/711x457/aHR0cDovL21lZGlhLmJlc3RvZm1pY3JvLmNvbS9IL0cvNTUyNzI0L29yaWdpbmFsL2ltYWdlMDExLnBuZw== https://img.purch.com/r/711x457/aHR0cDovL21lZGlhLmJlc3RvZm1p...
  - watersb 8y ago
    My Ivy Bridge laptop uses twice the power as my Apollo Lake laptop. Literally 2x.
    - NullPrefix 8y ago
      Apollo is Atom, isn't it? So it's not apples to apples. I'm pretty sure there were sub 10W SoC for some years before Ivy bridge.
- rectang 8y ago
  Planned obsolescence of otherwise viable product implemented via a certain-to-be-exploited architecture (the ME) followed by strategic withholding of patches?
  - 21 8y ago
    That's quite a conspiracy theory you got there. Things like these make people look at AMD again.
    - rectang 8y ago
      It doesn't have to have been a full-blown plan from years ago in order to be a viable strategy. Intel can choose planned obsolescence going forward today for selected products by not developing or releasing security patches. The extent to which this particular strategic business option was discussed during the design phase of the ME is hard to know from the outside. Surely someone within Intel pointed out that the ME was inherently insecure, but as for all the consequences, who knows?
      - 21 8y ago
        There are many ways to to planned obsolescence. I'm sure there is a way to just manufacture the chips such that they degrade in a few years. Planned obsolescence through major security bugs doesn't sound very smart to me. I don't get a vibe that Intel is enjoying this publicity or the presumed replace of those chips. My understanding is that AMD is quite competitive today in the data center.
        frankharv 8y ago
        The Intel C2xxx Chip was faulty and I wonder if there is more to this story. Like CPU degradation due to heat. Maybe the traces on the CPU just can't hold up to heat. The reason I say this is the top end C2750/C2758 seems to be more at risk then the C2338 dual core. This is unscientific just browsing forums. I think this is heat related. Wasn't the C2xxx series also an expensive server SOC. Man these guys are fumbling. [0]https://www.theregister.co.uk/2017/02/06/cisco_intel_decline_to_link_product_warning_to_faulty_chip/ https://www.theregister.co.uk/2017/02/06/cisco_intel_decline...
- nekocentral 8y ago
  Guilty, core i3 2120 and not planning on replacing anytime soon
- Kliment 8y ago
  There's always me_cleaner. It's a bit of a pain and requires hardware access to run but better than being exposed to an unpatchable vuln. I encourage every hackspace to set up an ME removal station (I'm building one for EMF Camp this year, and will document it so others can easily replicate)
  - deleted 8y ago
    [deleted]
  - confounded 8y ago
    Please do! I would love to do this, but am far too much of a sissy to mess with SPI flash. I've subscribed to your RSS feed. Do drop any guides/artifacts in the Noisebridge IRC when you have them :)
    - Kliment 8y ago
      Mitch will be at EMF, probably in a tent adjacent to mine. So I'll just ask him to bring the knowledge back to noisebridge.
- sebazzz 8y ago
  My Dell laptop doesn't have a way to activate it (Latitude) because Dell thought it was an paid feature. I am happy and safe.
simooooo 8y ago
What about i9?
avuton 8y ago
I'm oddly lucky that I based my fanless server off an old Atom platform.
- close04 8y ago
  "Luckily" most old Atoms will never get mitigations for Meltdown/Spectre :). So if you're using an Intel CPU today you'll just have to pick your poison.
  - avuton 8y ago
    I was under the impression that they weren't susceptible.
    - zzzcpan 8y ago
      So, old Atoms are the only ones still usable intel systems and not vulnerable to Meltdown/Spectre/ME.
      - namibj 8y ago
        No, the Xeon Phi "accelerators" are usable too, they are basically 486 cores on modern litography (to allow for higher density/clock speeds), with a vector unit attached to them. I don't know how hard it would be to boot linux on one though...
        deleted 8y ago
        [deleted]
        detaro 8y ago
        Only the first generation (X100 model numbers). If I remember right they ship with Linux already, but need a host system to run in of course.
        namibj 8y ago
exikyut 8y ago
Wow. The Web really has won. We have HTTP parsing failures in our CPUs.
- ajross 8y ago
  No, this is a firmware bug. It just happens to be firmware that runs on the ME and not the main cores. The code is stored externally to the CPU along with the BIOS, and looks like it's being patched via a BIOS update.
  - flafla2 8y ago
    The bug was part of the IME’s built in HTTP server, which is what the parent was alluding to.
    - ajross 8y ago
      Sure, but that's "in our CPUs" in, kinda, exactly the same way that nginx is. It's a microcontroller. It's not like the hardware implemented an HTTP server.
      - exikyut 8y ago
        If I just swap the paragraphs in your comment, > It's not like the hardware implemented an HTTP server. But yes, yes yes it is. I don't mean "in our CPUs" in the sense of running nginx. I say "in our CPUs" because - the Web server is physically inside the CPU die - you can't remove or change it thanks to code signing, so (to me) it's truly wedged in there In effect, it's as hardcoded as the electrical circuitry and the transistors are. Andrew Tannenbaum penned an open letter of surprise and shock because the use of MINIX was an implementation detail ("the licensing works for us, and it's been stared at by tons of professors and a bunch of smart kids for about 20 years, it's good"). Okay, so it's running on 3 little 486-and-a-bit class x86 cores, and it isn't embedded into the main execution pipelines (...yet. I can see that being attractive, something something "software defined ICE"). These details don't change the bigger picture - until someone can break the ME signing infra in a way Intel can't easily fix, and we can disable (or, more ideally, take over/pwn) ME for good, it's as good as mask ROM.
some_account 8y ago
I guess I should not be surprised that the HN community doesn't really seem to care. Intel put the Management Engine into every CPU with no choice from consumers to opt out. That alone is fairly surprising, since they knew it was a big chance it would have exploits and consumers would have no defense. But nobody reacts. Nobody cares.
- rrdharan 8y ago
  I'm curious what would you consider to count as an acceptable "reaction" from the HN community? At any rate I'm unlikely to provide one. Personally I probably won't care until a Snowden-like disclosure that demonstrates exploitation of the ME in a scenario that directly affects me. i.e. I wouldn't be surprised that nation states are exploiting this in targeted fashion, but nation states already have all kinds of ways to get my data in ways that I'm unlikely to be available to defend myself against if I'm targeted. I'd be more interested in hearing about how ME vulnerabilities are being used in US State-level dragnet surveillance or perhaps to subtly manipulate the population by changing their Google/Twitter/Facebook results or something of that nature. If you find any evidence of that, let me know.
  - nine_k 8y ago
    Imagine: "We, the U-Boot Command, don't care about fears and rumors until an exploit of the Enigma encryption technology is actually demonstrated." A good exploit is kept as invisible as possible, and when it is publicized, it may already be game over. A Trojan usually takes a lot of measure to stay undetected. Much of the recent crop of router-targeted exploits did not manifest their presence to the users in any way. Even with Snowden revelations, what has been shown was not just illicit mass data collection, but also huge reams of data already illicitly collected.
- turblety 8y ago
  I'm not sure nobody cares, there are a lot of people who do care and (like me) refuse to buy Intel products. I think the problem is there is no other competitor. Both Intel and AMD (or possibly a three letter agency) have colluded to ensure there are locked management engines in all of their products. Also people just don't understand what the ME actually is. It is surprising the HN community who are mostly technical don't see just how atrocious it really is. One thing to note however, is I tell my none technical associates there is a second computer in their laptop. It runs software meant to remotely control their computer. They they can not remove it, they can not see what it does, and there's frequently security bugs found in it. When I tell them this I get told I am paranoid and being stupid. However when I ask them to just imagine if it was true, wouldn't it be awful, they mostly agree. The issue is people really don't want to know the truth. It reminds me constantly of a quote from the matrix: "Many of them are so injured, so hopelessly dependent on the system, that they will that they will fight to protect it."
1001101 8y ago
A 10 year old buffer overflow? Are they not even running static analysis? If I was working with sensitive info, I would take precautions. I said this the last time the ME got patched: what are the chances that this is the last/only bug?

by nh2 8y ago

geggam 8y ago

Every time I am about to upgrade this happens. cpu0: Intel(R) Pentium(R) D CPU 3.00GHz, 2993.01 MHz

philjohn 8y ago
Grab an AMD Ryzen then - you can disable most of the PSP (their ME) via a BIOS setting, and even then, it doesn't do half of the scary stuff ME does.

Macha 8y ago

Also worth noting that they're not patching it for 1st, 2nd or 3rd generation Core CPUs. I'm sure there's plenty of Sandy Bridge/Ivy Bridge CPUs in the wild, and it's not like you have an option to discontinue use of the Intel ME :(

nebulous1 8y ago
My i7-2600 is still a beast (well, still gong strong anyway). They did the same thing with Meltdown/Spectre fixes.
- NullPrefix 8y ago
  Grandpa, it's time to upgrade.
  - coaxial 8y ago
    Why? Because it's been longer than intel would like since parent gave them money?
    - bhouston 8y ago
      If Intel has made currently processes ultra fast recently that wouldn't be an issue, but the Intel Core i7 2700 is actually not that slow. Roughly comparable, at least within 20%, of other 4 core + 4 HT Intel processors.
  - PostOnce 8y ago
    with an entry-level GPU and slow RAM that works with an i5-2500k, i can play every modern game i have tried on high. Nothing about me opening a text editor, interpreting most code, or compiling the occasional thing require anywhere near that much power. For the overwhelming majority, and i really mean overwhelming, there's really no progress or point to upgrading anything except the gpu in the past 7 years or so in laptops, new stuff uses a LOT less power for the same speed, so there's that I guess.
    - opencl 8y ago
      I upgraded my 2500k last year (to a Ryzen system) and the extra cores are very nice sometimes but honestly the biggest improvement was the fact that I also went from 8GB RAM to 16GB. There were a couple of games that benefited substantially from faster memory (Rise of the Tomb Raider, Fallout 4) but generally not so much the actual CPU performance.
  - deleted 8y ago
    [deleted]
  - deleted 8y ago
    [deleted]
NullPrefix 8y ago
No real advancement after Sandy Bridge was made. Only incremental 10% with each gen. That means current gen is only 2x as fast when comparing the same lines (i7 to i7). If you can't make new things better, just gimp the old ones, like Spectre/Meltdown.
- close04 8y ago
  2 times faster would be quite good actually. Sadly we're barely at 50% faster per core, and that's including the usual 20-30% frequency bump on newer models. Pure IPC improvement is even lower, at maybe 2-5% per generation (~30% total at same frequency, 2nd gen vs. 7th gen). Yeah, you could argue that doubling the core or thread count doubled performance in selected software but the reality is that for real world use, excluding specific corner cases, the improvement is hard to notice. A reason to upgrade is to have a newer platform and the features that would bring, definitely not the CPU.
- merb 8y ago
  well ddr4 is a huge improvement
  - Dylan16807 8y ago
    If you're memory-starved, yes. A typical quad core is not going to be memory-starved, and the effect is pretty mild compared to the effect of a GPU. Or for non-gaming, it either doesn't matter at all or is 90% about core count. https://img.purch.com/r/711x457/aHR0cDovL21lZGlhLmJlc3RvZm1pY3JvLmNvbS9IL0cvNTUyNzI0L29yaWdpbmFsL2ltYWdlMDExLnBuZw== https://img.purch.com/r/711x457/aHR0cDovL21lZGlhLmJlc3RvZm1p...
- watersb 8y ago
  My Ivy Bridge laptop uses twice the power as my Apollo Lake laptop. Literally 2x.
  - NullPrefix 8y ago
    Apollo is Atom, isn't it? So it's not apples to apples. I'm pretty sure there were sub 10W SoC for some years before Ivy bridge.
rectang 8y ago
Planned obsolescence of otherwise viable product implemented via a certain-to-be-exploited architecture (the ME) followed by strategic withholding of patches?
- 21 8y ago
  That's quite a conspiracy theory you got there. Things like these make people look at AMD again.
  - rectang 8y ago
    It doesn't have to have been a full-blown plan from years ago in order to be a viable strategy. Intel can choose planned obsolescence going forward today for selected products by not developing or releasing security patches. The extent to which this particular strategic business option was discussed during the design phase of the ME is hard to know from the outside. Surely someone within Intel pointed out that the ME was inherently insecure, but as for all the consequences, who knows?
    - 21 8y ago
      There are many ways to to planned obsolescence. I'm sure there is a way to just manufacture the chips such that they degrade in a few years. Planned obsolescence through major security bugs doesn't sound very smart to me. I don't get a vibe that Intel is enjoying this publicity or the presumed replace of those chips. My understanding is that AMD is quite competitive today in the data center.
      - frankharv 8y ago
        The Intel C2xxx Chip was faulty and I wonder if there is more to this story. Like CPU degradation due to heat. Maybe the traces on the CPU just can't hold up to heat. The reason I say this is the top end C2750/C2758 seems to be more at risk then the C2338 dual core. This is unscientific just browsing forums. I think this is heat related. Wasn't the C2xxx series also an expensive server SOC. Man these guys are fumbling. [0]https://www.theregister.co.uk/2017/02/06/cisco_intel_decline_to_link_product_warning_to_faulty_chip/ https://www.theregister.co.uk/2017/02/06/cisco_intel_decline...
nekocentral 8y ago
Guilty, core i3 2120 and not planning on replacing anytime soon
Kliment 8y ago
There's always me_cleaner. It's a bit of a pain and requires hardware access to run but better than being exposed to an unpatchable vuln. I encourage every hackspace to set up an ME removal station (I'm building one for EMF Camp this year, and will document it so others can easily replicate)
- deleted 8y ago
  [deleted]
- confounded 8y ago
  Please do! I would love to do this, but am far too much of a sissy to mess with SPI flash. I've subscribed to your RSS feed. Do drop any guides/artifacts in the Noisebridge IRC when you have them :)
  - Kliment 8y ago
    Mitch will be at EMF, probably in a tent adjacent to mine. So I'll just ask him to bring the knowledge back to noisebridge.
sebazzz 8y ago
My Dell laptop doesn't have a way to activate it (Latitude) because Dell thought it was an paid feature. I am happy and safe.

simooooo 8y ago

What about i9?

avuton 8y ago

I'm oddly lucky that I based my fanless server off an old Atom platform.

close04 8y ago
"Luckily" most old Atoms will never get mitigations for Meltdown/Spectre :). So if you're using an Intel CPU today you'll just have to pick your poison.
- avuton 8y ago
  I was under the impression that they weren't susceptible.
  - zzzcpan 8y ago
    So, old Atoms are the only ones still usable intel systems and not vulnerable to Meltdown/Spectre/ME.
    - namibj 8y ago
      No, the Xeon Phi "accelerators" are usable too, they are basically 486 cores on modern litography (to allow for higher density/clock speeds), with a vector unit attached to them. I don't know how hard it would be to boot linux on one though...
      - deleted 8y ago
        [deleted]
      - detaro 8y ago
        Only the first generation (X100 model numbers). If I remember right they ship with Linux already, but need a host system to run in of course.
        namibj 8y ago

exikyut 8y ago

Wow. The Web really has won. We have HTTP parsing failures in our CPUs.

ajross 8y ago
No, this is a firmware bug. It just happens to be firmware that runs on the ME and not the main cores. The code is stored externally to the CPU along with the BIOS, and looks like it's being patched via a BIOS update.
- flafla2 8y ago
  The bug was part of the IME’s built in HTTP server, which is what the parent was alluding to.
  - ajross 8y ago
    Sure, but that's "in our CPUs" in, kinda, exactly the same way that nginx is. It's a microcontroller. It's not like the hardware implemented an HTTP server.
    - exikyut 8y ago
      If I just swap the paragraphs in your comment, > It's not like the hardware implemented an HTTP server. But yes, yes yes it is. I don't mean "in our CPUs" in the sense of running nginx. I say "in our CPUs" because - the Web server is physically inside the CPU die - you can't remove or change it thanks to code signing, so (to me) it's truly wedged in there In effect, it's as hardcoded as the electrical circuitry and the transistors are. Andrew Tannenbaum penned an open letter of surprise and shock because the use of MINIX was an implementation detail ("the licensing works for us, and it's been stared at by tons of professors and a bunch of smart kids for about 20 years, it's good"). Okay, so it's running on 3 little 486-and-a-bit class x86 cores, and it isn't embedded into the main execution pipelines (...yet. I can see that being attractive, something something "software defined ICE"). These details don't change the bigger picture - until someone can break the ME signing infra in a way Intel can't easily fix, and we can disable (or, more ideally, take over/pwn) ME for good, it's as good as mask ROM.

some_account 8y ago

I guess I should not be surprised that the HN community doesn't really seem to care. Intel put the Management Engine into every CPU with no choice from consumers to opt out. That alone is fairly surprising, since they knew it was a big chance it would have exploits and consumers would have no defense. But nobody reacts. Nobody cares.

rrdharan 8y ago
I'm curious what would you consider to count as an acceptable "reaction" from the HN community? At any rate I'm unlikely to provide one. Personally I probably won't care until a Snowden-like disclosure that demonstrates exploitation of the ME in a scenario that directly affects me. i.e. I wouldn't be surprised that nation states are exploiting this in targeted fashion, but nation states already have all kinds of ways to get my data in ways that I'm unlikely to be available to defend myself against if I'm targeted. I'd be more interested in hearing about how ME vulnerabilities are being used in US State-level dragnet surveillance or perhaps to subtly manipulate the population by changing their Google/Twitter/Facebook results or something of that nature. If you find any evidence of that, let me know.
- nine_k 8y ago
  Imagine: "We, the U-Boot Command, don't care about fears and rumors until an exploit of the Enigma encryption technology is actually demonstrated." A good exploit is kept as invisible as possible, and when it is publicized, it may already be game over. A Trojan usually takes a lot of measure to stay undetected. Much of the recent crop of router-targeted exploits did not manifest their presence to the users in any way. Even with Snowden revelations, what has been shown was not just illicit mass data collection, but also huge reams of data already illicitly collected.
turblety 8y ago
I'm not sure nobody cares, there are a lot of people who do care and (like me) refuse to buy Intel products. I think the problem is there is no other competitor. Both Intel and AMD (or possibly a three letter agency) have colluded to ensure there are locked management engines in all of their products. Also people just don't understand what the ME actually is. It is surprising the HN community who are mostly technical don't see just how atrocious it really is. One thing to note however, is I tell my none technical associates there is a second computer in their laptop. It runs software meant to remotely control their computer. They they can not remove it, they can not see what it does, and there's frequently security bugs found in it. When I tell them this I get told I am paranoid and being stupid. However when I ask them to just imagine if it was true, wouldn't it be awful, they mostly agree. The issue is people really don't want to know the truth. It reminds me constantly of a quote from the matrix: "Many of them are so injured, so hopelessly dependent on the system, that they will that they will fight to protect it."

1001101 8y ago

A 10 year old buffer overflow? Are they not even running static analysis? If I was working with sensitive info, I would take precautions. I said this the last time the ME got patched: what are the chances that this is the last/only bug?