Intel published recently a severe security vulnerability in their website. A lot of processor families are affected. Using their tool my laptop was identified as affected. Any idea how to mitigate such issues in Ubuntu?
Thanks in advance
1
-
security.stackexchange.com/a/175725/4077 here is related answer with link to detection tool– Grzegorz WierzowieckiDec 18, 2017 at 23:23
Add a comment
|
1 Answer
Your primary answer to this will be found at the end of the Intel article itself:
Intel highly recommends checking with your system OEM for updated firmware. Links to system manufacturer pages concerning this issue can be found at http://www.intel.com/sa-00086-support
Basically, they are telling you that the manufacturer of your computer will need to provide updated firmware. If, like me, you cannot update the firmware in your machine, we can only hope that at some not distant point in time an updated intel_microcode package will be available for Linux.
It is worth noting that this is not strictly about Ubuntu or Linux in general: The problem is a firmware issue and related to the underlying machine rather than the OS. How quickly this becomes resolved will largely depend upon how seriously the manufacturer approaches this problem. As of the time that I write this, the Intel support page links to statements by Dell and Lenovo, and apparently Lenovo intends to issue an update by 2017/11/24.
answered Nov 21, 2017 at 15:29
-
1Do these tie in with the "addressing black hole" bug which allows any code with ring-zero access to set the address of the interrupt controller to a range used by ring-minus-2 firmware? If so, it may be worthwhile to note that it's possible for exploit code to hide itself well enough that even a memory scanner with root-level access would be unable to detect it, while it secretly injects security vulnerabilities into other software which would be undetectable until remotely triggered. Nasty stuff.– supercatNov 21, 2017 at 19:00
-
-
@supercat I haven't encountered "addressing black hole" bug before, but the second sentence is accurate. This is very problematic. Nov 22, 2017 at 22:56
-
@flindeberg: The problem is that Intel allows ring-zero code to set the address of an interrupt control module, and hardware that routes memory accesses will map all addresses in the specified range to registers within that module rather than memory. If one sets the address of the module so it obscures the memory that the System Management Mode logic uses to make decisions about how it should handle requests, many vendors' existing SMM functions will then make exploitably-wrong decisions. Fixing the SMM logic would not be hard for someone with the physical means of...– supercatNov 22, 2017 at 23:48
-
...installing the fix. Storing a non-zero value in a location that would always read zero when obscured by the interrupt controller, and testing that it reads non-zero would suffice. The problem is that in many cases there's no easy way for an end user to install such a patch, though perhaps it might be possible to write a pseudo-exploit which, if the hole is exploitable, would use the hole itself to install a suitable patch.– supercatNov 22, 2017 at 23:49