Intel SPI Flash Flaw Allows BIOS and UEFI Deletion

[wahdangun]

. While having your OS compromised is certainly not a good thing, but I assure you that most [H]'ers would rather see their OS corrupted with malware than your BIOS or UEFI being deleted. Don't worry though, this only affects pretty much every Intel CPU in use today, so at least there is an upside. Seems that Bleeping Computer has been talking to Lenovo on this. Maybe we could get them to ask Lenovo about NVIDIA GPP? Thanks @cageymaru.


According to Lenovo, who recently deployed the Intel fixes, "the configuration of the system firmware device (SPI flash) could allow an attacker to block BIOS/UEFI updates, or to selectively erase or corrupt portions of the firmware."

Intel deployed fixes for this vulnerability (CVE-2017-5703) on April 3. The chipset maker says the following CPU series utilize unsafe opcodes that allow local attackers to take advantage of this security bug:

https://hardforum.com/threads/intel-spi-flash-flaw-allows-bios-and-uefi-deletion.1958740/

Look like with more robust OS security, hardware security flaw will be the most targeted.

 

[eton975]

Literally happened to me. Hopefully it was just a bad UEFI update from MS, but the symptoms it produced were disconcerting ie. PC sometimes booting, then suddenly shutting off, or refusing to allow me to change settings by shutting off if I tried:

(This would imply active malware or corruption in such a way that the UEFI was overwriting itself. As you hopefully know, (modern) BIOS/UEFI flashing requires a valid key signed by CPU manufacturer and/or motherboard manufacturer.)

I hope you believe I'm not just telling a tall tale here, btw. Also have videos I can share privately for more detailed proof.

 

[LTC8K6]

https://www.youtube.com/watch?v=n9rNv7xOrKg

 

[plopke]

https://security-center.intel.com/advisory.aspx?intelid=INTEL-SA-00087&languageid=en-fr
was out during the same time the entire AMD Ryzenfall etc was still main focus of tech news , this one rarely got any attention.
The 3th major issues that affect the last 6 or more years of intel cpu's , at least they are cleaning house I guess.