4 ms·

Your CPU actually runs its own entire, separate operating system - MINIX. https://www.cs.vu.nl/~ast/intel/ https://www.cs.vu.nl/~ast/intel/

ganzuul 8y ago
This is known, but that link has no information relevant to the HTTP protocol. Do you know more about that?
- close04 8y ago
  Well, the ME can be accessed via a web GUI (16992/16993 ports). That's the web server. https://software.intel.com/en-us/node/632310 https://software.intel.com/en-us/node/632310 I have multiple machines with AMT and I'm actively using it every day. Some get patches, some won't because they're gen 3 CPUs or lower. Luckily I can be reasonably confident that the local network is secure so the bug isn't exploitable. This time. I'm sure hoping AMD does better with their support of the PSP.
  - lurker456 8y ago
    That's to access AMT. AMT is a module running on top of ME and is disabled by default.
    - close04 8y ago
      And it's exactly what the CVEs are about, isn't it? From the article: vulnerability enables full-blown remote code execution in the AMT process of the Management Engine. From Intel: https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00112.html https://www.intel.com/content/www/us/en/security-center/advi... Buffer overflow in HTTP handler in Intel® Active Management Technology in Intel Converged Security Manageability Engine
      - zamadatix 8y ago
        Yes, it's what the CVEs are about, but the whole comment thread has been riddled with people talking past one another creating confusion: - The CVEs are about AMT portion only not the base IME - Not all affected hardware will be patched (based on age) - AMT can be disabled (and is by default) - IME/AMT run on a croprocessor on the motherboard - not the CPU itself - AMT runs an HTTP server for IPMI abilities
        antpls 8y ago
        > - AMT can be disabled (and is by default) The devices which have the feature enabled are probably business devices and the feature is used to manage them. Business devices are good value targets, I guess. Edit : I guess those devices will probably receive the fix, since they are managed
        gnufx 8y ago
        > - AMT runs an HTTP server for IPMI abilities IPMI doesn't use HTTP. AMT/vPro is apparently not for servers, and likely operates on the system NIC. The first rule of out-of-band management interfaces should be "use a physically-separate interface", which is unfortunately frequently broken (by one vendor when the procurement specified a separate interface).
PeCaN 8y ago
IIRC for many generations it was ThreadX, which is a proprietary RTOS.
bogomipz 8y ago
Wow I have never seen this before. All the other incredulities aside I was very surprised by this: >"I got another clue when your engineers began asking me to make a number of changes to MINIX, for example, making the memory footprint smaller and adding #ifdefs around pieces of code so they could be statically disabled by setting flags in the main configuration file." Why would Intel ask Tannenbaum to make changes for them? Doesn't intel have unlimited resources?
- maccam94 8y ago
  Probably to lower their maintenance overhead by minimizing their divergence from the upstream code.

ganzuul 8y ago

This is known, but that link has no information relevant to the HTTP protocol. Do you know more about that?

close04 8y ago
Well, the ME can be accessed via a web GUI (16992/16993 ports). That's the web server. https://software.intel.com/en-us/node/632310 https://software.intel.com/en-us/node/632310 I have multiple machines with AMT and I'm actively using it every day. Some get patches, some won't because they're gen 3 CPUs or lower. Luckily I can be reasonably confident that the local network is secure so the bug isn't exploitable. This time. I'm sure hoping AMD does better with their support of the PSP.
- lurker456 8y ago
  That's to access AMT. AMT is a module running on top of ME and is disabled by default.
  - close04 8y ago
    And it's exactly what the CVEs are about, isn't it? From the article: vulnerability enables full-blown remote code execution in the AMT process of the Management Engine. From Intel: https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00112.html https://www.intel.com/content/www/us/en/security-center/advi... Buffer overflow in HTTP handler in Intel® Active Management Technology in Intel Converged Security Manageability Engine
    - zamadatix 8y ago
      Yes, it's what the CVEs are about, but the whole comment thread has been riddled with people talking past one another creating confusion: - The CVEs are about AMT portion only not the base IME - Not all affected hardware will be patched (based on age) - AMT can be disabled (and is by default) - IME/AMT run on a croprocessor on the motherboard - not the CPU itself - AMT runs an HTTP server for IPMI abilities
      - antpls 8y ago
        > - AMT can be disabled (and is by default) The devices which have the feature enabled are probably business devices and the feature is used to manage them. Business devices are good value targets, I guess. Edit : I guess those devices will probably receive the fix, since they are managed
      - gnufx 8y ago
        > - AMT runs an HTTP server for IPMI abilities IPMI doesn't use HTTP. AMT/vPro is apparently not for servers, and likely operates on the system NIC. The first rule of out-of-band management interfaces should be "use a physically-separate interface", which is unfortunately frequently broken (by one vendor when the procurement specified a separate interface).

PeCaN 8y ago

IIRC for many generations it was ThreadX, which is a proprietary RTOS.

bogomipz 8y ago

Wow I have never seen this before. All the other incredulities aside I was very surprised by this: >"I got another clue when your engineers began asking me to make a number of changes to MINIX, for example, making the memory footprint smaller and adding #ifdefs around pieces of code so they could be statically disabled by setting flags in the main configuration file." Why would Intel ask Tannenbaum to make changes for them? Doesn't intel have unlimited resources?

maccam94 8y ago
Probably to lower their maintenance overhead by minimizing their divergence from the upstream code.