This Intel CPU Security Flaw Is Impossible To Fix, Affects Recent Chips' Chain Of Trust
Security researchers are sounding the alarm on a vulnerability present in practically every processor Intel has released in the past five years. According to the researchers, the vulnerability is "impossible to fix" and "jeopardizes everything Intel has done to build the root of trust and lay a solid security foundation on the company's platforms." In other words, it's a bit o a big deal, as far as the researchers are concerned. It's entirely separate from the side-channel exploits that made headlines since the initial Spectre and Meltdown disclosure.
Researches at Positive Technologies describe the flaw as an "error in Intel hardware," as well as in the company's Converged Security and Management Engine (CSME) firmware for modern platforms. They also say it exists in the very early stages of the subsystem's operation, in the boot ROM, which is why it can't be fixed—ROM, or Read Only Memory, cannot be written to.
"The scenario that Intel system architects, engineers, and security specialists perhaps feared most is now a reality... the problem is not only that it is impossible to fix firmware errors that are hard-coded in the Mask ROM of microprocessors and chipsets. The larger worry is that, because this vulnerability allows a compromise at the hardware level, it destroys the chain of trust for the platform as a whole," Positive Technologies stated in a blog post.
CSME is the subsystem within Intel's CPUs and chipsets that underpins various security technologies, including DRM, fTPM (firmware-based Trusted Platform Module), and Intel Identity Protection. These are used for hardware-based encryption, authentication, and other security features. And in theory, it is all susceptible to hacking.
Positive Technologies says the vulnerability affects every Intel chipset and SoC available today other than the company's latest 10th generation chips.
"The vulnerability allows extracting the chipset key and manipulating part of the hardware key and the process of its generation. However, currently it is not possible to obtain that key's hardware component (which is hard-coded in the SKS) directly. The vulnerability also sets the stage for arbitrary code execution with zero-level privileges in Intel CSME," Positive Technologies explains.
While this can't be fixed entirely, there are mitigations to be had for various attack vectors, and Intel has already released a patch for one them. However, Positive Technologies points out "there might be many ways to exploit" the vulnerability in ROM, the insinuation being that a single patch is a not a cure-all.
It's not clear how feasible these attacks would be, though. The researchers note that some of the exploits might require local access and others might even require physical access to a system. Those types of infiltration are much harder to pull off.
Positive Technologies plans to provide more technical details in a full-length white paper to be published soon.
Update: Intel has released the following statement in regards to this vulnerability...
