Intel Finally Squashes Decade-Old Remote Code-Execution AMT Bug In Processor Platforms
The good news here is that Intel-based consumer PCs are completely unaffected by this bug. However, business customers who own PCs with vPro processors often use these technologies for remote administration purposes, and for them this is a serious bug. Or "critical," as Intel rates it, as it opens the door for an unprivileged attacker to gain control of the manageability features provided the aforementioned products.
Intel notes two ways the vulnerability might be access:
- An unprivileged network attacker could gain system privileges to provisioned Intel manageability SKUs: Intel Active Management Technology (AMT) and Intel Standard Manageability (ISM).
*CVSSv3 9.8 Critical /AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- An unprivileged local attacker could provision manageability features gaining unprivileged network or local system privileges on Intel manageability SKUs: Intel® Active Management Technology (AMT), Intel® Standard Manageability (ISM), and Intel Small Business Technology (SBT).
*CVSSv3 8.4 High /AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
There is some debate over the actual real-world implications of this bug. SemiAccurate said it's been aware of the bug for a long time and that what it discovered "was scary on a level that literally kept us up at night." It couldn't publish the information it found for fear that it would be immediately exploited by attackers, but was persistent in reminding Intel that it had a serious flaw on its hands.
The threat here is that a hacker could access a vulnerable PC's hardware and install malware or otherwise wreak havoc, all without the operating system or antivirus software noticing that something is awry. Since AMT has direct access to a computer's network hardware, a hacker could conceivably hijack every PC on the network.
Issuing a patch would normally make this a moot point, though this is not a Windows Update that gets automatically dole out. Instead, it is up to PC makers to release the fix through a firmware upgrade. Those who choose not to for whatever reason leave their customers at risk.