Intel Management Engine vulnerability SA-00086

J Z wrote: Hello, see -> http://forum.asrock.com/forum_posts.asp?TID=6676&title=wichtig-intel-mei-firmware-v118503425

daddyo wrote: It was surprising to see how patronizing a moderator was regarding this issue. For those who have NOT read Intel's statement yet, they clearly have placed the initiative to resolve this serious security hole on the OEM providers, which Asrock would be in the case of motherboards. Considering that any consumer Intel CPU made since fall of 2015 is affected, you can expect there will be attempts to make use of this vulnerability wherever it is unpatched.  I await Asrock's official response. -- Edit--  I did notice on their website that ME engine and CPU microcode updates have been released on some server motherboards, and 300 series chipset based motherboards... I hope more will come! I just bought my z270 extreme4 a month ago. I would expect them to issue updates for 200 and 100 series motherboards as well.

From the start of this, it was obvious that the only simple method of fixing this issue, is via a UEFI/BIOS update. The articles about this have very little detail, and are not definitive statements from Intel.

MY frustration is the mother board manufacture, ASRock in this case, being taken to task and at best blamed for the fix not being available immediately.

My main point only is, ASRock and all the other mother board manufactures are not responsible for this issue. Is that true or false?

We already see the angry posts in this thread, which is so frustrating. Yes, the mother board manufactures are stuck with the responsibility of providing the fix for this issue. But they did not create the IME hardware and software, any more than they manufacture the processors used in a mother board.

So why are people mad at ASRock?

They want a statement from ASRock, but what do they want it to say? That ASRock will provide the UEFI/BIOS updates? Of course, that is obvious and reasonable. How could any mother board manufacture not do that, provide the updates? I do not officially speak for ASRock in this case, but I'm sure as I can be that the UEFI/BIOS updates will be available.

I'm surprised anyone is concerned about the updates not being provided. Not providing the fix in a UEFI/BIOS update would alone be a huge PR disaster.

Forgive this dumb post, i just want to be notified of further announcements/posts here regarding this issue. 

J Z wrote: soulstealer wrote: J Z wrote: Hello, see -> http://forum.asrock.com/forum_posts.asp?TID=6676&title=wichtig-intel-mei-firmware-v118503425 sorry, but is this asrock official? we just need some clarity. Hello, It is official and you can see the address from the link and it comes from ASRock only in advance and soon on the ASRock website

No no no JZ. Post is on Asrock forum but link with zip file which you provided http://asrock.pc.cdn.bitgravity.com/TSD/ME-consumer_11.8.50.3425.zip have Asrock in name but domain is totally different so from my point of view its not legit.

J Z wrote: Other manufacturers have not provided anything official

That's not entirely true though. My work laptop is a Lenovo ThinkPad T560 which the tool identified as already patched as are a whole lot of other models (but not all affected): https://support.lenovo.com/ie/en/product_security/len-17297

INTEL-SA-00086 Detection Tool Risk Assessment Based on the analysis performed by this tool: This system is not vulnerable. It has already been patched. For more information refer to the SA-00086 Detection Tool Guide or the Intel security advisory Intel-SA-00086 at the following link: https://security-center.intel.com/advisory.aspx?intelid=INTEL-SA-00086&languageid=en-fr INTEL-SA-00086 Detection Tool Application Version: 1.0.0.128 Scan date: 23/11/2017 11:00:35 Host Computer Information Name: XXXXXXXXX Manufacturer: LENOVO Model: 20FJS06J00 Processor Name: Intel(R) Core(TM) i7-6600U CPU @ 2.60GHz OS Version: Microsoft Windows 10 Enterprise Intel(R) ME Information Engine: Intel(R) Management Engine Version: 11.8.50.3425 SVN: 3 Copyright(C) 2017, Intel Corporation, All rights reserved.

Not complaining but would reiterate OP's request for a comment on the matter. I'm not expecting a patch by the end of the day!

Fatal1ty Z170 Gaming K6+ owner.




Edited by rico - 23 Nov 2017 at 7:11pm