The hijacking flaw that lurked in Intel chips is worse than anyone thought

Re:The hijacking flaw that lurked in Intel chips is worse th... by kogepathic on Sunday May 07, 2017 @04:12AM (#14284412)

> would mean total control of the host, i.e. privileges above any software you can run on a computer.

You don't need arbitrary code execution, the ME already has privileges above any software you can run on the computer. The ME operates in ring -2 mode [0], whereas the OS kernel has at most ring 0 privileges.

With the built-in ME functionality you can: reboot the host, change BIOS settings, re-install the OS, update BIOS (boot FreeDOS & run the vendor utility).

Couple this with a vendor vulnerability such as not signing and verifying a BIOS before flashing, and you can easily use the ME to flash a BIOS with malicious components to the computer.

So, yes, it's not as bad as using the ME to read arbitrary memory regions while the host is on, but the default ME functionality for remote management is still enough for a malicious actor to cause a lot of harm.

[0] https://en.wikipedia.org/wiki/System_Management_Mode

[ Parent | on HN ]

Re:The hijacking flaw that lurked in Intel chips is worse th... by pritambaral on Sunday May 07, 2017 @05:05AM (#14284550)

> ring -2 mode

ME runs below the SMM. So ring -3 or lower.

[ Parent | on HN ]

Re:The hijacking flaw that lurked in Intel chips is worse th... by qb45 on Sunday May 07, 2017 @05:17AM (#14284585)

ME is a separate processor, not a "ring" on the x86.

All this talk about "privilege level above normal software" and "ring -7" just muddies the water. It simply is a physically separate core running its own software which has access to all RAM and all PCIe devices and can program the Intel NIC to silently redirect selected packets away from the x86 cores to itself.

[ Parent | on HN ]