Intel Platform Vulnerability Lets Malware Erase or Block UEFI Firmware Updates

[btarunr]

A new Intel platform vulnerability emerged, chronicled by the company under CVE-2017-5703, dated April 3, which could let malware erase your motherboard UEFI BIOS, or render the EEPROM chip storing it "read-only" forever, preventing future BIOS updates, exploiting vulnerabilities in Intel's implementation of the SPI (serial peripheral interface) on its platforms. The vulnerability affects all Intel processors dating all the way back to 5th generation "Broadwell." The company quietly passed on fixes to its OEM partners to release as BIOS updates.

The vulnerability came to light in the public as Lenovo, Intel's largest OEM partner, deployed BIOS updates for its vulnerable products, while detailing it. Lenovo describes the vulnerability as "the configuration of the system firmware device (SPI flash) could allow an attacker to block BIOS/UEFI updates, or to selectively erase or corrupt portions of the firmware." It goes on to add that "this would most likely result in a visible malfunction, but could in rare circumstances result in arbitrary code execution." Intel said it discovered the vulnerability internally and hasn't noticed any exploits in the wild that take advantage of it. "Issue is root-caused, and the mitigation is known and available," the company said in a security advisory. "To Intel's knowledge, the issue has not been seen externally."



View at TechPowerUp Main Site

 

[champsilva]

This kind of "silente updates" is non-exception to the rule.

All major companies will do this to prevent mass knowledge and a possible outbreak

 

[_JP_]

I know that is a common EEPROM, but "SU 27 D" triggered my brain differently...

 

[eidairaman1]

I know that is a common EEPROM, but "SU 27 D" triggered my brain differently...

I knew what you were talkin about.

Well this is yet again another flaw.

 

[qubit]

Intel has such a great handle on security nowadays!

 

[Hood]

So my 4th gen Haswell Z97 system isn't vulnerable to this latest thing? Still no BIOS to fix Spectre, though. Thanks, Intel - what's next, exploding chipsets?

 

[dorsetknob]

Intel has such a great handle on security nowadays!

What did you expect ( this is the company that Bought McAfee )

 

[qubit]

What did you expect ( this is the company that Bought McAfee )

Good point. And McAfee is no better, is it?

 

[trparky]

Makes me so glad that I'm going with AMD Ryzen next week and leaving Intel behind. By going with AMD I get the added benefit of not having to take a shower after the purchase.

 

[Ferrum Master]

I'll crack a joke too...

Trusted Execution Platform

 

[Arrakis9]

So my 4th gen Haswell Z97 system isn't vulnerable to this latest thing? Still no BIOS to fix Spectre, though. Thanks, Intel - what's next, exploding chipsets?

You probably do have the security update for spectre/meltdown installed via windows update, you should check your patch history.

 

[trparky]

You probably do have the security update for spectre/meltdown installed via windows update, you should check your patch history.

Um... no. If we go by this Microsoft KB Article (KB4090007) they only have microcode updates going back to the 6th generation.

 

[R-T-B]

Makes me so glad that I'm going with AMD Ryzen next week and leaving Intel behind. By going with AMD I get the added benefit of not having to take a shower after the purchase.

AMD has it's own set of issues. Take a shower regardless.

 

[Hood]

You probably do have the security update for spectre/meltdown installed via windows update, you should check your patch history.

Here's a screenshot of Inspectre, the small utility to check Spectre and Meltdown vulnerability. My Haswell system has the latest Microsoft updates, but obviously no BIOS update (yet,if ever). When you scroll down in the Inspectre utility, it explains in detail why you're covered or not covered. https://www.grc.com/inspectre.htm This is a tiny (124KB) exe file that runs portable (no install), and it's the easy way to see if your system is vulnerable to either of these exploits. BTW, this is after today's (manual) update to Redstone 4, plus the first cumulative update for rs4 1803.

 

[_JP_]

AMD has it's own set of issues. Take a shower regardless.

But you can use the loofah instead of sandpaper

 

[enxo218]

intel is a tiring company with its incompetence in security

 

[Hood]

intel is a tiring company with its incompetence in security

Not just Intel, it's every company. What's tiring is that Intel has the money to do a lot better, but their stockholders would rather pocket the cash Damned capitalism!