Windows 10: Intel is releasing Direct Connect Interface (DCI) policy update

Brink · Jul 10, 2018

Intel ID: INTEL-SA-00127 Product family: 5th and 6th generation Intel® Xeon® Processor E3 family, Intel® Xeon® Scalable processors, and Intel® Xeon® Processor D family Impact of vulnerability: Information Disclosure, Escalation of Privilege Severity rating: Important Original release: 07/09/2018 Last revised: 07/09/2018
Summary:

Intel is releasing Direct Connect Interface (DCI) policy update.

Description:

Existing UEFI setting restrictions for DCI (Direct Connect Interface) in 5th and 6th generation Intel® Xeon® Processor E3 Family, Intel® Xeon® Scalable processors, and Intel® Xeon® Processor D Family can potentially allow a limited physical presence attacker to access platform secrets via debug interfaces.

Affected products:

• Note: Client platforms are not included in the following table, because all client platforms are expected to have EFI Secure Boot enabled & the UEFI Variable controlling DCI set to default disabled.

Potentially Affected Platform Mitigated Platform sample code Code Name Purley:
Intel® Xeon® Scalable processors Available in Post Launch Release 7
or later on VIP @ https://platformsw.intel.com Code Name Greenlow:
Intel® Xeon® Processor E3 v6 Family (Kaby Lake)
Intel® Xeon® Processor E3 v5 Family (Skylake) Perform a code review based on TA content and remove the vulnerability as necessary. Code Name Bakerville:
Intel® Xeon® Processor D Family (Skylake-D) Available in Post Launch Release 2
or later on VIP @ https://platformsw.intel.com Code Name Harrisonville:
Intel® Atom ™ Processor C Series (Denverton) Perform a code review based on TA content and remove the vulnerability as necessary.
Recommendations:

Intel highly recommends that all potentially affected platforms that have not implemented one of the items listed above implement the changes described below. These changes modify the DCI policy such that DCI control is disabled. Below are references to Purley, Bakerville, and Greenlow codebases.

• Sample Code Filename:
Greenlow filename: PeiPchPolicyDebugLib.c

Purley/Bakerville filename: PeiPchPolicyUpdate.c
• Code to change in Sample Code File:
PchPolicy->DciConfig.DciEn = 0;

PchPolicy->DciConfig.DciAutoDetect = 0;
Acknowledgements:

Intel would like to thank Jesse Michael from Eclypsium for reporting this issue and working with us on coordinated disclosure.

Revision History

Revision Date Description 1.0 07/09/2018 Initial Release
CVE Name: CVE-2018-3652
Click to expand...

Source: INTEL-SA-00127

:)

Brink · Jul 10, 2018

Intel Management Engine Vulnerability and Surface Devices

Microsoft is aware of the Intel Management Engine vulnerability (Intel-SA-00086). The Intel vulnerability detection tool currently lists Microsoft Surface devices as vulnerable to this security advisory.Microsoft has investigated the issue and found the following:

Remote exploit of this vulnerability requires Intel Active Management Technology (AMT). Current Surface devices do not allow remote connectivity to the ME because our devices do not run AMT.

Local exploit of this vulnerability requires Direct Connect Interface (DCI) access via USB, which is not provided on Surface devices.

Because of this, we believe exploits using this vulnerability are significantly reduced on Surface devices. We care deeply about ensuring our devices are reliable and secure and are working with Intel to generate fixes for current devices, which we expect to release in the near future.
Click to expand...

Source: Intel Management Engine Vulnerability and Surface Devices Surface

btarunr · Jul 10, 2018

Intel Readies P55 Chipset B3 Stepping Update

Intel's is readying a hardware update for its P55 Express chipset, currently the only core-logic for the company's brand new socket LGA-1156 processor platform. The new B3 stepping of the P55 PCH will bring with it a little more than new MM number and S-spec numbers. A list of changes is as follows:

New MM number and S-spec numbers for the converted products;

Firmware and minor BIOS updates are required with the conversion;

Processor MRC/microcode update required to enable future processors;

Recommended storage driver upgrade from Intel MSM 8.9 to Intel RST 9.5.

Although it is listed that the MRC update enables 'future processors', Intel, in a statement issued to X-bit labs assured that the current B2 stepping of the chipset (found on current socket LGA-1156 motherboards) does not leave out support for any of Intel's new LGA-1156 processors that are slated for release in the very near future. The dual-core "Clarkale" 32 nm processor will be supported by both B2 and B3 steppings of the chipset.

P55 B3 stepping is pin-identical to P55 B2, and hence motherboard vendors will not have to come up with new designs. Sampling of the new stepping began as early as on October 02, 2009, and it is scheduled for shipment to manufacturers by the 7th of December, 2009. P55 is the performance core-logic for the LGA-1156 platform. It supports Core i5 and Core i7 "Lynnfield" processors with discrete graphics.

Source: X-bit labs

Spacemanrob · Jul 10, 2018

Intel Management Engine Interface forced update?

Motherboard GA-H110M-S2H

CPU I5 6500

The suggested Intel Management Engine Interface update by my motherboard manufacturer is 11.6.0.1030, so that's what I download and install, only for Windows 10 to force a further update to 11.7.0.1032, is it correct for this to happen?

Windows 10: Intel is releasing Direct Connect Interface (DCI) policy update

Intel is releasing Direct Connect Interface (DCI) policy update

Intel is releasing Direct Connect Interface (DCI) policy update

Intel is releasing Direct Connect Interface (DCI) policy update

Intel is releasing Direct Connect Interface (DCI) policy update - Similar Threads - Intel releasing Direct

IVAP Interface connection

IVAP Interface connection

IVAP Interface connection

Intel Management Engine Interface Driver

VIRTUALINBOX INTERFACE CONNECTION

Intel Management Engine Interface ISSUE

Intel(r) management engine interface

eSPI Interface Intel Atom - E3930

Intel Trusted Execution Engine Interface Driver