6

INTEL-SA-00075 describes a vulnerability in the Intel AMT/ISM/SBT firmware. From Intels own bulletin this is a threat both locally and remotely.

How is a threat in the local scenario? I understand the threat at the network level, but Intel states, this vulnerability remains a threat at the local level.

From their bulletin:

An unprivileged local attacker could provision manageability features gaining unprivileged network or local system privileges on Intel manageability SKUs

I don't understand how this presents a threat. If the service is not provisioned, then there is no threat, and in order to provision the service, a user needs administrative privileges (or needs to have physical access). If a user has admin privileges already then exploiting this buys them nothing (and physical access implies root privileges anyways, ala usb attacks among others). Am I missing something?

  • Where did you read that it is vulnerable even if it is not provisioned? – codah May 11 '17 at 14:47
  • From the bulletin "An unprivileged local attacker could provision manageability features gaining unprivileged network or local system privileges on Intel manageability SKUs" – n00b May 11 '17 at 15:12
  • 1
    I believe the concern is for systems that are using Intel AMT for management already. If the service isn't running, it can't be exploited. If the service is running but other manageability features are not yet provisioned, the attacker can provision them and gain further access. – Polynomial May 11 '17 at 15:56
  • Right but how do they provision the service (with what rights)? If they already have the rights to provision then there is no new threat – n00b May 11 '17 at 16:18
  • Is there a conclusive answer to this question? – CrabMan Jun 28 '17 at 15:25
1

As @polynomial explained above: "If the [LMS] service isn't running, it can't be exploited."

However, in terms of a local environment, it would be more accurate to state: "As long as the service is not running on the target computer or any computer with permissions to manage that computer" then the is no exploit to be had.

For example, if the DC has LMS running, but the CEO's computer did not, the DC could be compromised, and group policy could be used to install LMS on the CEO's computer, and then AMT could be accessed.

  • And by LMS, you mean...? – Dog eat cat world Nov 10 '17 at 22:20
  • LMS is the AMT management service that runs in windows to communicate between the OS and the firmware. – K.B. Dec 21 '17 at 21:03
1

I believe there are multiple conflicting definitions of "provisioned". AMT (remote access) provisioning; vs intel AMT service install/exec as system.

A device can be running the LMS software, yet the AMT hardware not be configured for remote access; if the LMS software can reconfigure the hardware to enable remote access (and set arbitrary credentials) then the vulnerability allows hardware level remote code execution.

If the hardware access is configured/enabled already, the software vector is irrelevant. (You don't even need an operating system for remote control/virtual disk access)

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.