8

I read about the security vulnerability that Intel explains here

On other sites I have read that Intel Core-i CPUs are affected too and that Intel AMT has to do with the vPro name.

Their guide on finding out if you are affected asks me to check for the vPro badge, so I started by checking if my systems support vPro.

I have a desktop Intel CPU (4790K) that according to Intel's Ark doesn't have the vPro feature, as well as the Z97 chipset. Can I now assume that I am not affected by the vulnerability on that machine?

On another system I have a Xeon E3-1220v5 CPU that does have the vPro feature according to Intel's Ark. However, the C232 chipset that I am using with it doesn't have the vPro feature. Can I also assume here that I am safe from the mentioned vulnerability?

Both system are running Linux and BSD.

9

Based on Matthew Garrett - Intel's remote AMT vulnerablity, which is among the most reasonable (in terms of amount of hyperbole) articles I've seen so far, you can only be affected if your system meets all four of the following criteria:

  • A CPU supporting Active Management Technology
  • A motherboard chipset supporting AMT
  • Supported network hardware
  • The Management Engine firmware contains the AMT firmware

There is no guarantee if your system meets all four criteria that it is affected, but if it does not meet all four, then it cannot be affected by the vulnerability as currently known.

Based on your statement that the chipsets in both your systems do not support vPro (of which AMT is one part), we can then conclude that neither meets all four criteria and thus neither system can be affected.

Specifically, in order to be affected, you need to have vPro, but having vPro-capable hardware alone is not sufficient to be affected; your system also needs to have the AMT nuts and bolts (e.g. its firmware) installed. That would under every normal circumstance be done by your system vendor.

Apparently, under Linux, you can check for AMT by looking at the lspci output; if lspci lists no communications controller with MEI in the description, then AMT is not running and you are safe.

  • Out of curiosity I ran lspci on my Linux box (4790K, Z97) and I actually do have a line containing this: 'Communication controller: Intel Corporation 9 Series Chipset Family ME Interface #1'. How can I interpret this, given the fact that neither the CPU nor the chipset should support vPro? – comfreak May 2 '17 at 14:30
  • @comfreak I don't know; I haven't had Intel CPUs in my systems for the last dozen plus years. You could re-run lspci with the -n parameter to get the PCI IDs, and see what your search engine of choice turns up. – a CVn May 2 '17 at 14:36
  • The attack vector is AMT and AMT does run on non vPro processors, albeit in a reduced functionality mode called standard manageability (software.intel.com/en-us/blogs/2009/03/27/…). For this reason I believe that non vPro machines are also vulnerable. Do you have a resource from Intel specifically stating CVE-2017-5689 is only applicable to vPro processors? They actually state Standard Manageability machines are vulnerable (security-center.intel.com/…) – Gaia May 6 '17 at 18:10
4

Am I affected by the Intel AMT/ISM/SBT escalation of privilege vulnerability?

nmap provide a new sript : http-vuln-cve2017-5689 to detect the AMT vulnerability by scanning your system.

Under linux system copy the http-vuln-cve2017-5689.nse script to your :

/usr/share/nmap/scripts/ then update the nmap database : nmap --script-updatedb

To use it run the following command:

nmap -p 16992 --script http-vuln-cve2017-5689 Your_local_IP_system

Sample output from nmap documentation:

PORT      STATE SERVICE       REASON
16992/tcp open  amt-soap-http syn-ack
| http-vuln-cve2017-5689:
|   VULNERABLE:
|   Intel Active Management Technology INTEL-SA-00075 Authentication Bypass
|     State: VULNERABLE
|     IDs:  CVE:CVE-2017-5689  BID:98269
  • That's great for the part of the vulnerability that is exploitable over the network but from what I have read there is a part that can be exploited locally. Is there a simple detection for that too? – comfreak May 8 '17 at 22:59
  • 1
    Intel makes a detection tool for local scanning: downloadcenter.intel.com/download/26755 – HackSlash Nov 28 '17 at 19:06

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.