6

INTEL-SA-00075 describes a vulnerability in the Intel AMT/ISM/SBT firmware. From Intels own bulletin this is a threat both locally and remotely.

How is a threat in the local scenario? I understand the threat at the network level, but Intel states, this vulnerability remains a threat at the local level.

From their bulletin:

An unprivileged local attacker could provision manageability features gaining unprivileged network or local system privileges on Intel manageability SKUs

I don't understand how this presents a threat. If the service is not provisioned, then there is no threat, and in order to provision the service, a user needs administrative privileges (or needs to have physical access). If a user has admin privileges already then exploiting this buys them nothing (and physical access implies root privileges anyways, ala usb attacks among others). Am I missing something?

Improve this question
5
  • Where did you read that it is vulnerable even if it is not provisioned?
    – codah
    Commented May 11, 2017 at 14:47
  • From the bulletin "An unprivileged local attacker could provision manageability features gaining unprivileged network or local system privileges on Intel manageability SKUs"
    – n00b
    Commented May 11, 2017 at 15:12
  • 1
    I believe the concern is for systems that are using Intel AMT for management already. If the service isn't running, it can't be exploited. If the service is running but other manageability features are not yet provisioned, the attacker can provision them and gain further access.
    – Polynomial
    Commented May 11, 2017 at 15:56
  • Right but how do they provision the service (with what rights)? If they already have the rights to provision then there is no new threat
    – n00b
    Commented May 11, 2017 at 16:18
  • Is there a conclusive answer to this question?
    – CrabMan
    Commented Jun 28, 2017 at 15:25

2 Answers 2

Reset to default
1

As @polynomial explained above: "If the [LMS] service isn't running, it can't be exploited."

However, in terms of a local environment, it would be more accurate to state: "As long as the service is not running on the target computer or any computer with permissions to manage that computer" then the is no exploit to be had.

For example, if the DC has LMS running, but the CEO's computer did not, the DC could be compromised, and group policy could be used to install LMS on the CEO's computer, and then AMT could be accessed.

Improve this answer
2
  • And by LMS, you mean...?
    – Dog eat cat world
    Commented Nov 10, 2017 at 22:20
  • LMS is the AMT management service that runs in windows to communicate between the OS and the firmware.
    – K.B.
    Commented Dec 21, 2017 at 21:03
1

I believe there are multiple conflicting definitions of "provisioned". AMT (remote access) provisioning; vs intel AMT service install/exec as system.

A device can be running the LMS software, yet the AMT hardware not be configured for remote access; if the LMS software can reconfigure the hardware to enable remote access (and set arbitrary credentials) then the vulnerability allows hardware level remote code execution.

If the hardware access is configured/enabled already, the software vector is irrelevant. (You don't even need an operating system for remote control/virtual disk access)

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .