8

I read about the security vulnerability that Intel explains here

On other sites I have read that Intel Core-i CPUs are affected too and that Intel AMT has to do with the vPro name.

Their guide on finding out if you are affected asks me to check for the vPro badge, so I started by checking if my systems support vPro.

I have a desktop Intel CPU (4790K) that according to Intel's Ark doesn't have the vPro feature, as well as the Z97 chipset. Can I now assume that I am not affected by the vulnerability on that machine?

On another system I have a Xeon E3-1220v5 CPU that does have the vPro feature according to Intel's Ark. However, the C232 chipset that I am using with it doesn't have the vPro feature. Can I also assume here that I am safe from the mentioned vulnerability?

Both system are running Linux and BSD.

Improve this question
1

2 Answers 2

Reset to default
9

Based on Matthew Garrett - Intel's remote AMT vulnerablity, which is among the most reasonable (in terms of amount of hyperbole) articles I've seen so far, you can only be affected if your system meets all four of the following criteria:

  • A CPU supporting Active Management Technology
  • A motherboard chipset supporting AMT
  • Supported network hardware
  • The Management Engine firmware contains the AMT firmware

There is no guarantee if your system meets all four criteria that it is affected, but if it does not meet all four, then it cannot be affected by the vulnerability as currently known.

Based on your statement that the chipsets in both your systems do not support vPro (of which AMT is one part), we can then conclude that neither meets all four criteria and thus neither system can be affected.

Specifically, in order to be affected, you need to have vPro, but having vPro-capable hardware alone is not sufficient to be affected; your system also needs to have the AMT nuts and bolts (e.g. its firmware) installed. That would under every normal circumstance be done by your system vendor.

Apparently, under Linux, you can check for AMT by looking at the lspci output; if lspci lists no communications controller with MEI in the description, then AMT is not running and you are safe.

Improve this answer
3
  • Out of curiosity I ran lspci on my Linux box (4790K, Z97) and I actually do have a line containing this: 'Communication controller: Intel Corporation 9 Series Chipset Family ME Interface #1'. How can I interpret this, given the fact that neither the CPU nor the chipset should support vPro?
    – comfreak
    May 2, 2017 at 14:30
  • @comfreak I don't know; I haven't had Intel CPUs in my systems for the last dozen plus years. You could re-run lspci with the -n parameter to get the PCI IDs, and see what your search engine of choice turns up.
    – user
    May 2, 2017 at 14:36
  • The attack vector is AMT and AMT does run on non vPro processors, albeit in a reduced functionality mode called standard manageability (software.intel.com/en-us/blogs/2009/03/27/…). For this reason I believe that non vPro machines are also vulnerable. Do you have a resource from Intel specifically stating CVE-2017-5689 is only applicable to vPro processors? They actually state Standard Manageability machines are vulnerable (security-center.intel.com/…)
    – Gaia
    May 6, 2017 at 18:10
4

Am I affected by the Intel AMT/ISM/SBT escalation of privilege vulnerability?

Nmap provides a new script http-vuln-cve2017-5689 to detect the AMT vulnerability by scanning your system.

On Linux systems, copy the http-vuln-cve2017-5689.nse script to /usr/share/nmap/scripts/, then update the nmap database with nmap --script-updatedb.

To use it, run the following command:

nmap -p 16992 --script http-vuln-cve2017-5689 Your_local_IP_system

Sample output from the Nmap documentation:

PORT      STATE SERVICE       REASON
16992/tcp open  amt-soap-http syn-ack
| http-vuln-cve2017-5689:
|   VULNERABLE:
|   Intel Active Management Technology INTEL-SA-00075 Authentication Bypass
|     State: VULNERABLE
|     IDs:  CVE:CVE-2017-5689  BID:98269
Improve this answer
2
  • That's great for the part of the vulnerability that is exploitable over the network but from what I have read there is a part that can be exploited locally. Is there a simple detection for that too?
    – comfreak
    May 8, 2017 at 22:59
  • 1
    Intel makes a detection tool for local scanning: downloadcenter.intel.com/download/26755
    – HackSlash
    Nov 28, 2017 at 19:06

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .