Intel SPI Flash Flaw Allows BIOS and UEFI Deletion

FrgMstr

FrgMstr

Just Plain Mean
Staff member
Joined
May 18, 1997
Messages
55,602
While having your OS compromised is certainly not a good thing, but I assure you that most [H]'ers would rather see their OS corrupted with malware than your BIOS or UEFI being deleted. Don't worry though, this only affects pretty much every Intel CPU in use today, so at least there is an upside. Seems that Bleeping Computer has been talking to Lenovo on this. Maybe we could get them to ask Lenovo about NVIDIA GPP? Thanks cageymaru.


According to Lenovo, who recently deployed the Intel fixes, "the configuration of the system firmware device (SPI flash) could allow an attacker to block BIOS/UEFI updates, or to selectively erase or corrupt portions of the firmware."

Intel deployed fixes for this vulnerability (CVE-2017-5703) on April 3. The chipset maker says the following CPU series utilize unsafe opcodes that allow local attackers to take advantage of this security bug:
 
I'm still waiting for ASUS to provide a BIOS update for Spectre/Meltdown or whatever much less this new flaw ... :-\ Can't wait til Threadripper 2
 
  • Like
Reactions: WhoMe
like this
Yay, supposedly none of my systems are vulnerable as my newest is running a 4930k. Looks to only be gen 5 and higher.
 
erek said:
I'm still waiting for ASUS to provide a BIOS update for Spectre/Meltdown or whatever much less this new flaw ... :-\ Can't wait til Threadripper 2
Click to expand...
Why bother? Who's gonna go thru that much effort to attack you and your porn stash data?
 
Big_Rig_Stig said:
That's why I use steaks laced with Quaaludes...
Click to expand...
Might work with the golden retriever, she'll eat anything: the rest would be too busy eating you. Seriously it's not as easy drugging dogs with pills as people think...their digestive tracks are short and they don't always adsorb as much as you'd think.
 
Looks like all the decisions security vs speed are coming home to roost.

Wonder how many people were fired, demoted, reassigned, or pushed out, for speaking up against such decisions?
 
Local access vulnerabilities should still be treated as critical as ever. I know there was lots of downplaying of these kinds of defects recently after the CTS Labs hype, but let's not get too complacent. We're already way down on the slippery slope when it comes to <insert literally everything wrong with the world>.
 
I would say the same as I would for AMD if it's a local attacker all bets are off anyway.
 
So where is the white paper regarding Intel stock as junk, eventually reaching $0.00?
 
Gigabyte (and possibly others) have been using 2 bios/ufei chips just about forever. Asus (and possibly others) has had a way to emergency flash your bios with a backup image when you power up your system for a few years now.

I don't think this kind of thing is such a huge problem anymore.
 
Big_Rig_Stig said:
Because investors know that anything Wintel-based is fucked & their pet security companies will make bank.
Click to expand...

well, only if they were shorting the stock. Intel is actually at their 52 week high so somebody is investing with confidence.
 
ep0x73 said:
well, only if they were shorting the stock. Intel is actually at their 52 week high so somebody is investing with confidence.
Click to expand...
Yeah, they see a whole bunch of people having to replace their processors over this shit.
 
trparky said:
Yeah, they see a whole bunch of people having to replace their processors over this shit.
Click to expand...
I wouldn't be shocked if Intel was responsible for the DRAM shortage and just bought up supply to keep system build costs much higher til they launched a CPU that was more competitive. Who would put that past Intel after all and/or Micron for that matter. To me that seems like par for course for the type of **** that Intel would pull.
 
cyberguyz said:
Gigabyte (and possibly others) have been using 2 bios/ufei chips just about forever. Asus (and possibly others) has had a way to emergency flash your bios with a backup image when you power up your system for a few years now.

I don't think this kind of thing is such a huge problem anymore.
Click to expand...
It's a bigger issue with servers that need to be online 24hrs a day, or the like. For home users it's more of a nuisance than a money issue, unless you have to buy a new motherboard because of it.
The gigabyte x370 k5 would be hosed after two corrupt bioses, btw. It doesn't have any way to flash the backup while on the main bios.
 
You must log in or register to reply here.
Back
Top