[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
Re: [Libreboot] Zero-day vulnerability - system management mode arbitrar
Re: [Libreboot] Zero-day vulnerability - system management mode arbitrary code execution
Wed, 06 Jul 2016 01:34:10 +0100
K-9 Mail for Android
All right, reading the article, it seems one of the given exploits can disable
SPI flash write-protection mechanisms. This might mean that we can install
Libreboot/Coreboot without an external flash tool on systems with proprietary
I will read it more carefully, and test this on my Lenovo X200, which has
proprietary BIOS installed. If it doesn't work one suspects it will just refuse
access to me. If it does, this is very useful, even if the rest of the exploits
don't remove ME from recent models.
Hope this helps anyone,
On 6 July 2016 00:52:11 BST, Duncan Guthrie <address@hidden> wrote:
>Poking around the internet, I happened upon this page:
>This is an exploit for System Management Mode of Intel x86 CPUs, tested
>on a number of recent models, including Lenovo ThinkPads, and tested on
>some other models including an HP Pavilion laptop. This suggests that
>this vulnerability exists in a wide range of recent Intel hardware. The
>page links to this extensive blog post:
>What excites me about this is that as we are running code at such a low
>level, we might in theory be able to bypass the Intel ME signature
>checking and similar "protections", and run unsigned BIOS software.
>This would be great for Libreboot.
>Can anyone else comment on this? I am quite excited at the potential of
>this, especially as it seems to be able to target many new models of
>Intel hardware, perhaps even Intel hardware produced this year, as
>Intel, as far as I know, didn't introduce any major design changes for
>a long time as they did not need to.
Sent from my Android device with K-9 Mail. Please excuse my brevity.