Is there a nice semi-automated way that I would just paste output of my
lspci, or any other hardware description and get suggestions to what kind of vulnerabilities a given computer may be subject to (and hints how to fix them)?
SA00086_Linuxtar.gz - For Linux* Users
The version of the tool is a command line executable that will display a risk assessment for the system being tested.
Note: Versions of the INTEL-SA-00086 Detection Tool earlier than 22.214.171.124 did not check for CVE-2017-5711 and CVE-2017-5712. These CVE's only affect systems with Intel Active Management Technology (Intel AMT) version 8.x-10.x. Users of systems with Intel AMT 8.x-10.x are encouraged to install version 126.96.36.199, or later, to help verify the status of their system in regards to the INTEL-SA-00086 Security Advisory.
CHIPSEC is arguably the most comprehensive tool for analyzing firmware security to date.
The first answer provided resources for detecting whether or not INTEL-SA-00086 affects you. There is another, the CHIPSEC framework, which scans your BIOS/UEFI for various security issues and reports it to you. It is frequently updated in response to new information. From their Github page:
CHIPSEC is a framework for analyzing the security of PC platforms including hardware, system firmware (BIOS/UEFI), and platform components. It includes a security test suite, tools for accessing various low level interfaces, and forensic capabilities. It can be run on Windows, Linux, Mac OS X and UEFI shell.
It is capable of providing information on various capabilities of your firmware, and whether or not it is configured to resist modification from software. There are many ways to overwrite firmware with privileged access, and your firmware has to lock itself down properly. Even missing one detail can result in firmware which can be modified at runtime. It can also provide details on specific vulnerabilities, and on more mild issues such as whether or not your keyboard buffer contains keystrokes entered while in the BIOS, which could disclose your BIOS password.
Note that CHIPSEC output can appear rather arcane at times. It is designed to be used as a framework by researchers and firmware vendors, so it does not go into detail about the implications of various issues it has found. The manual gives more details about the purpose of each module, and this page provides information on some of the more common modules and vulnerabilities. You can also expand its functionality by writing custom modules. It is a framework, after all.
Example output from the
[+] imported chipsec.modules.common.bios_wp [x][ ======================================================================= [x][ Module: BIOS Region Write Protection [x][ ======================================================================= BIOS Control (BDF 0:31:0 + 0xDC) = 0x2A  SMM_BWP = 1 (SMM BIOS Write Protection)  TSS = 0 (Top Swap Status)  BLE = 1 (BIOS Lock Enable)  BIOSWE = 0 (BIOS Write Enable) [+] BIOS region write protection is enabled (writes restricted to SMM) [*] BIOS Region: Base = 0x00500000, Limit = 0x00FFFFFF SPI Protected Ranges ------------------------------------------------------------ PRx (offset) | Value | Base | Limit | WP? | RP? ------------------------------------------------------------ PR0 (74) | 00000000 | 00000000 | 00000000 | 0 | 0 PR1 (78) | 8FFF0F40 | 00F40000 | 00FFF000 | 1 | 0 PR2 (7C) | 8EDF0EB1 | 00EB1000 | 00EDF000 | 1 | 0 PR3 (80) | 8EB00EB0 | 00EB0000 | 00EB0000 | 1 | 0 PR4 (84) | 8EAF0C00 | 00C00000 | 00EAF000 | 1 | 0 [!] SPI protected ranges write-protect parts of BIOS region (other parts of BIOS can be modified) [+] PASSED: BIOS is write protected