How to identify and patch a hardware vulnerability?

Question

Software and systems vulnerabilities are often patched with updates, or by avoiding the use of some OS or softwares that have multiple flaws. Regarding hardware vulnerabilities, I do not have a lot of knowledge. To better understand the situation I have two question:

• How to check for a hardware vulnerabilities on some devices (e.g. PCs)?
• How to patch a hardware vulnerability?

Here is an example:

Summary:

Intel is releasing mitigations for a privilege escalation issue. This issue affects certain Intel processors based on older Intel micro-architectures. The issue identified is a method that enables malicious code to gain access to System Management Mode (SMM).

Description:

An issue was disclosed to Intel which leverages architectural differences in processors prior to 2nd Generation Intel® Core™ Processors to gain access to System Management Mode (SMM). Administrator or root level privileges are required to execute the attack.

Answer 1

I'll be using modern Intel CPUs as an example of hardware. For most other hardware, you can identify bugs, but often you cannot patch it, but only work around it by trying to avoid the buggy behavior.

Hardware bugs are identified similarly to the ways bugs are identified in closed source software. Internal audits and reports in the wild are mostly responsible. Unfortunately, there are a lot of bugs which we will never discover both due to the closed source and highly secret nature of these devices, and the incredible complexity of how they operate.

Due to the fact that CPUs are incredibly complex, CPUs are released with the expectation that they will have bugs. As a result, Intel has designed them to be updated. Only in absolutely disastrous cases does Intel have to recall the actual hardware. But even though they are hardware, but they can also load firmware which overrides some of the hardware circuits with firmware code, called microcode. This microcode is stored inside the CPU and must be loaded at each boot. It contains fixes for known errata. Typically, the microcode is stored in the BIOS, which applies it while the CPU loads. The operating system also contains a more up to date version which is applied as well.

In the specific case you mention, they are releasing mitigations in the form of microcode updates. These updates will be present in new BIOSes (theoretically, at least. I'm sure many BIOS vendors will be far too incompetent... but that's another discussion), and in updates to operating systems, which apply the microcode updates to the CPU during boot.