Slashdot is powered by your submissions, so send in your scoop

 



Forgot your password?
typodupeerror
×
Intel Security

Intel SPI Flash Flaw Lets Attackers Alter or Delete BIOS/UEFI Firmware (bleepingcomputer.com) 46

Catalin Cimpanu, writing for BleepingComputer: Intel has addressed a vulnerability in the configuration of several CPU series that allow an attacker to alter the behavior of the chip's SPI Flash memory -- a mandatory component used during the boot-up process [1, 2, 3]. According to Lenovo, who recently deployed the Intel fixes, "the configuration of the system firmware device (SPI flash) could allow an attacker to block BIOS/UEFI updates, or to selectively erase or corrupt portions of the firmware." Lenovo engineers say "this would most likely result in a visible malfunction, but could in rare circumstances result in arbitrary code execution."
This discussion has been archived. No new comments can be posted.

Intel SPI Flash Flaw Lets Attackers Alter or Delete BIOS/UEFI Firmware

Comments Filter:
  • Not another industry-wide patching, I hope. I can't take another industry-wide patching.
  • Where? (Score:3, Funny)

    by Anonymous Coward on Sunday April 15, 2018 @04:07PM (#56442403)

    Wait, where's the slick marketing name for the vulnerability? Where's the logo? The website?

  • Applied the Fix (Score:4, Informative)

    by DaMattster ( 977781 ) on Sunday April 15, 2018 @04:21PM (#56442469)
    It is always hairy when you apply a firmware fix but I am pleased to say that Lenovo's update for the ThinkCentre M70 works just fine. Although, it took a while to apply and power cycled 3 times. At one point I almost said, "Fuck! It bricked."
    • by Anonymous Coward

      It is always hairy when you apply a firmware fix but I am pleased to say that Lenovo's update for the ThinkCentre M70 works just fine. Although, it took a while to apply and power cycled 3 times. At one point I almost said, "Fuck! It bricked."

      Replying as AC but the issue here is actually that the default configuration provided as a reference was insecure. There was no actual flaw, just insecure defaults.

  • by Anonymous Coward

    I am tired of having to rely on software security measures that will inevitably not work. Give me a fucking switch to turn off write access in hardware. The IT industry sucks.

    • Did you know that the audio chips don't really care which is a microphone and which is the speaker, and that either can be reprogrammed to the either? You don't need to bother unplugging your microphone if you're leaving your speakers plugged in. It's all software these days.

      • Re: (Score:3, Insightful)

        by Anonymous Coward

        Speakers attached to an external amplifier can't be abused as microphones.

    • They can't. (Score:3, Informative)

      by Anonymous Coward

      They literally (intentionally?) broke the SPI write-lock switch back in the 8 MBit days and instead made it 'write-lock *ONLY IF* hardware sense pin+post-power on software enable are both set.' What does that mean in layman's terms? Glitching power can cause the SPI flash to believe it has been power cycled. Since the write protect requires software intervention to enable and since said write protect function is only normally run at boot time, said glitching can unlock the bios write protect post-boot, allo

  • by Anonymous Coward

    foiled again.

    -some agency

  • All these Intel security flaws are insane. If the next MacBook Air replacement runs on Apple's A12 or whatever, I'm switching.

  • We can now jailbreak the laptop, and install our own open-souce, secure boot rom!

    Let's get busy!

  • by Anonymous Coward

    we can use this flaw to patch out Intel ME?

    • That's what I was wondering. Is this the same as using Intel's Flash Programming Tool to flash a me_cleaner version of a BIOS without Intel ME?
  • The problem was uncovered by Ubuntu last year: https://linux.slashdot.org/sto... [slashdot.org]
    It was so grave they had to pull down released version and patch the workaround.

  • Is that another flaw that's only patched through their windows updater ?

Karl's version of Parkinson's Law: Work expands to exceed the time alloted it.

Working...