Forum - RE: Intel Management Engine: Drivers, Firmware & System Tools

Win-Raid Forum (Drivers - Firmware - Modding) � Special Topics � Intel Management Engine � Intel (Converged Security) Management Engine: Drivers, Firmware and Tools

Page 247 of 380 � Page 1 ... 242 243 244 245 246 247 248 249 250 251 ... 380 Page �

Topic settings

Print view

Jump to forum

General & Forum related Topics News / Announcements Forum-related Questions & Suggestions Off Topic Important Drivers (AHCI/RAID, NVMe, USB etc.) General: Storage Drivers (AHCI/RAID, NVMe and USB) Specific: Intel AHCI/RAID Drivers Specific: NVIDIA nForce Chipset Drivers (incl. AHCI/RAID) Specific: NVMe Drivers Other Drivers System Performance RAID Performance AHCI/NVMe Performance Solid State Drives BIOS Modding BIOS Modding Guides and Problems BIOS modules (PCI ROM, EFI and others) BIOS Modding Requests Reports: BIOS Modding Results Offers: Already modded special BIOSes Special Topics Intel Management Engine CPU Microcodes NVMe Support for old Systems Other Tools (not BIOS modding related) Interesting PC Hardware & Software OS related Topics Windows 11 Windows 8-10/Server 2012-2019 Windows 7/Vista/Server 2008 Windows XP/2000/Server 2003 DOS/Windows 3.X/9X/ME - Retro Gaming Other Operating Systems

#3691 | RE: Intel Management Engine: Drivers, Firmware & System Tools datum

Sat Jan 06, 2018 11:29 pm

Zitat von plutomaniac im Beitrag #3680
Intel ME 7 5MB Firmware v7.1.92.3273

any idea what this new version actually does? I'm surprised there is new version released for ME 7 since 7.1.91.3272 was last and Intel stated ME 7 is already out-of-support. I guess it is not related to SA00086 because there is no mention in user guide about this version. *ME 6-10 only Corporate SKUs are vulnerable , fw fixes only for ME 8+ so basically Intel ME 6-7 are out of luck and left vulnerable :(

reply

#3692 | RE: Intel Management Engine: Drivers, Firmware & System Tools datum

Sat Jan 06, 2018 11:51 pm (Last edited: Sat Jan 06, 2018 11:52 pm)

Zitat
EK Revoke State is mystery, I successfully re-keyed with latest Intel ME drivers (I have Platform re-key capable True though) but still FPF state remained Revoked so don't think it FPF value can be reversed.
Also not really sure what Revoke state actually means, but Intel PTT TPM is still usable with this state without any issue so far.

Were you actually using TPM with bitlocker when you updated ME firmware? I was, so maybe FPF Revoke state is changed to Revoked when you actually use TPM (EK). Most people don't use TPM so it stays Not revoked after Intel ME fw fix.

Just to be sure I cleared CMOS, cleared TPM, and encrypted whole drive from fresh. FPF Revoke state still remains Revoked though.

I suspended Bitlocker before updating (not disabled, suspended); now I disabled it and updated to 11.8.50.3426 (was 11.8.50.3399), still same output; maybe this EK is not related to tpm, or I'm missing something, don't know.
Cleared TPM multiple times.

Hope someone with full knowledge can shed some light

TPM fully usable before and after

reply

#3693 | RE: Intel Management Engine: Drivers, Firmware & System Tools datum

Sun Jan 07, 2018 12:32 am (Last edited: Sun Jan 07, 2018 12:33 am)

I think it may be related actually, because when you suspend bitlocker, bitlocker keys are still present in TPM.
So when you update ME with any key present in TPM (key is generated in EK chain) I think that's where FPF EK gets to revoked state. Maybe if you've turned off bitlocker and cleared tpm, then there shouldn't be any keys in EK chain and FPF would have stayed Not revoked.
That's why most people don't have FPF Revoke State Revoked, because most of the people don't actually use Intel PTT TPM.

Just speculating.

reply

#3694 | RE: Intel Management Engine: Drivers, Firmware & System Tools datum

Sun Jan 07, 2018 12:51 am (Last edited: Sun Jan 07, 2018 12:57 am)

plutomaniac:
Do you know how to install Intel MEI v11.0.6.1194 (AMT 6 & 7 Corporate) Drivers & Software from your first post on AMT7 Corporate board with ME firmware v7.1.91.3272

setup only installs MEI driver, according to log there is a problem with detecting fw version

Getting FW version.
Message sent.
Waiting for FW version response.
Message received
E Wrong device answer length
Disconnecting driver interface.
E Error detecting SKU, Defaulting to MEI only.

any idea how to skip this check or force install of everything?

Last version which installs everything is Intel MEI 10.0.39.1003 Corporate

Thanks.

reply

#3695 | RE: Intel Management Engine: Drivers, Firmware & System Tools datum

Sun Jan 07, 2018 8:01 pm (Last edited: Sun Jan 07, 2018 8:03 pm)

Intel CSME 11.8 Slim PCH-H Firmware v11.8.50.3425 (INTEL-SA-00086)

Intel CSME 11.8 Slim PCH-LP Firmware v11.8.50.3425 (INTEL-SA-00086)

Notice for INTEL-SA-00086 vulnerability:

Tip: You can wait for Apple to release their new UEFI updates with CSME v11.8.50.3425 Slim H/LP when macOS 10.13.3 is out of beta.

reply

#3696 | RE: Intel Management Engine: Drivers, Firmware & System Tools datum

Tue Jan 09, 2018 6:23 pm

There is a new Intel Management Engine driver ver: 11.7.0.1057 date: 11/19/2017 here https://necacom.net/index.php/intel/mei/...1-7-0-1065-whql

reply

#3697 | RE: Intel Management Engine: Drivers, Firmware & System Tools datum

Tue Jan 09, 2018 6:36 pm

Intel MEI v11.7.0.1065 for Consumer systems Drivers & Software
Intel MEI Driver v11.7.0.1057 (Windows 8 & Windows 10) INF for manual installation
Intel MEI Driver v11.7.0.1057 (Windows XP & Windows 7) INF for manual installation

Intel CSME 11.21 Corporate PCH-H Firmware v11.21.50.1429

Intel CSME 11.11 Consumer PCH-H Firmware v11.11.50.1436

Intel CSME System Tools v11 r6 (ReUp)

reply

#3698 | RE: Intel Management Engine: Drivers, Firmware & System Tools datum

Tue Jan 09, 2018 6:40 pm

be careful with that archive files inside are from 2012 and 2016 year, and I did not even scanned for malware - deleted.

reply

#3699 | RE: Intel Management Engine: Drivers, Firmware & System Tools datum

Tue Jan 09, 2018 8:13 pm

I managed to update my Asrock B85M Pro 4's ME firmware from 9.0 to 9.1 using an update provided by Lenovo for their think stations. I was originally trying to extract FWUpdate.exe but the Lenovo Util ended up automatically flashing the firmware without any error.
Now SA-00086 detection tool says my vulnerability has been patched and I am on the latest 9.1.42.3002 version.

I can't run MEInfo to verify but everything seems to be working ATM.

reply

#3700 | RE: Intel Management Engine: Drivers, Firmware & System Tools datum

Fri Jan 12, 2018 6:08 pm

Zitat von Metalwell im Beitrag #3689
Hello, I am using Z170X-G3 Gigabyte and my FWUpdate is locked to Disabled. I have the latest bios from the manufacturer. however whatever I tried to do I could not patch Intel ME to fix the vulnerabilirty, I mailed them regarding this matter. I was wondering if there is any other way around to fix it? Thank you!

I think I have a similar issue with updating ME firmware to fix Intel-SA-00086 vulnerability on ASUS Z170-A motherboard with i7-6700K on a latest BIOS 3504. FWUpdLcl64.exe gives "Error 8719: Firmware update cannot be initiated because Local Firmware update is disabled". Details on ASUS site if anyone is interested ASUS forums. ASUS support suggests that it is "obviously" hardware fault or damaged firmware and that I should send my motherboard to the service center of the shop where I purchased it. From what I have found on the net regarding Error 8719, it is a BIOS bug. BIOS is working fine, no crashes, I even tried running MEManuf from Intel CSME System Tools v11 r6 that checks if ME is operating correctly if I understood it right, which gives no errors.

Intel MEInfo 11.8.50.3425 also reports Local FWUpdate as Disabled. Does anyone know if there anyway to enable it so that I can update my ME firmware? Or the only solution is to wait for ASUS to release new BIOS for my motherboard and hope that they will fix it?

reply

#3701 | RE: Intel Management Engine: Drivers, Firmware & System Tools datum

Sat Jan 13, 2018 12:01 am

Seems like Intel is going to implode. Another security flaw just discovered affecting AMT:

https://www.techspot.com/news/72736-inte...-corporate.html

reply

#3702 | RE: Intel Management Engine: Drivers, Firmware & System Tools datum

Sat Jan 13, 2018 1:25 am

That's no flaw (or you could say unknown or undocumented feature). If you don't change any default passwords it's just your own fault. I can't believe some security expert consider this a security flaw. You could say that any computer with remote management (IMM, ILO, DRAC) is flawed by default then or just any device which use login credentials (pretty much everything) is flawed.

reply

#3703 | RE: Intel Management Engine: Drivers, Firmware & System Tools datum

Sat Jan 13, 2018 7:41 am

Zitat von broheim im Beitrag #3705
Zitat von Metalwell im Beitrag #3689
Hello, I am using Z170X-G3 Gigabyte and my FWUpdate is locked to Disabled. I have the latest bios from the manufacturer. however whatever I tried to do I could not patch Intel ME to fix the vulnerabilirty, I mailed them regarding this matter. I was wondering if there is any other way around to fix it? Thank you!

I think I have a similar issue with updating ME firmware to fix Intel-SA-00086 vulnerability on ASUS Z170-A motherboard with i7-6700K on a latest BIOS 3504. FWUpdLcl64.exe gives "Error 8719: Firmware update cannot be initiated because Local Firmware update is disabled". Details on ASUS site if anyone is interested ASUS forums...

So today ASUS released a new BIOS 3703 for Z170-A and I still get Error 8719 and can't update vulnerable ME firmware. Is there any way to enable Local Firmware update?

If not, what can I do to reduce the impact on security of outdated and vulnerable ME firmware? Please note that I am not security specialist, I'm just wondering what can I do to prevent remote exploits from the network? For example, I assume that using Intel NIC on the motherboard is not recommended?

reply

#3704 | RE: Intel Management Engine: Drivers, Firmware & System Tools datum

Sat Jan 13, 2018 1:43 pm

Zitat von broheim im Beitrag #3708
So today ASUS released a new BIOS 3703 for Z170-A and I still get Error 8719 and can't update vulnerable ME firmware. Is there any way to enable Local Firmware update?

That option is controlled by a BIOS option. It might be hidden in your BIOS menu but it's definitely there. ASUS should have that set to Enable by default, not Disabled.

reply

#3705 | RE: Intel Management Engine: Drivers, Firmware & System Tools datum

Sat Jan 13, 2018 6:42 pm (Last edited: Sat Jan 13, 2018 8:39 pm)

I downloaded and manually updated the new Asus Z170-A BIOS 3703 from the local SSD, no problems.

-------[ ME Analyzer v1.42.0 r110 ]-------

File: Z170-A-ASUS-3703.CAP (1/1)

Family: CSE ME
Version: 11.6.10.1196
Release: Production
Type: Region, Extracted
SKU: Consumer H
Rev: D0
SVN: 1
VCN: 173
LBG: No
PV: Yes
Date: 2016-11-16
FIT Ver: 11.6.10.1196
FIT SKU: PCH-H Z170
Size: 0x1F0000
Platform: SPT/KBP
Latest: No

Intel(R) MEInfo Version: 11.8.50.3425
Copyright(C) 2005 - 2017, Intel Corporation. All rights reserved.

Intel(R) ME code versions:

BIOS Version 3703
MEBx Version 0.0.0.0000
GbE Version 0.7
Vendor ID 8086
PCH Version 31
FW Version 11.8.50.3426 H
Security Version (SVN) 3
LMS Version Not Available
MEI Driver Version 11.7.0.1057
Wireless Hardware Version Not Available
Wireless Driver Version Not Available

FW Capabilities 0x31111540

Intel(R) Capability Licensing Service - PRESENT/ENABLED
Protect Audio Video Path - PRESENT/ENABLED
Intel(R) Dynamic Application Loader - PRESENT/ENABLED
Intel(R) Platform Trust Technology - PRESENT/DISABLED

Re-key needed False
Platform is re-key capable True
TLS Disabled
Last ME reset reason Firmware reset
Local FWUpdate Enabled
BIOS Config Lock Enabled
GbE Config Lock Enabled
Host Read Access to ME Enabled
Host Write Access to ME Disabled
Host Read Access to EC Disabled
Host Write Access to EC Disabled
SPI Flash ID 1 EF4018
SPI Flash ID 2 Unknown
BIOS boot State Post Boot
OEM ID 00000000-0000-0000-0000-000000000000
Capability Licensing Service Enabled
OEM Tag 0x00000000
Slot 1 Board Manufacturer 0x00000000
Slot 2 System Assembler 0x00000000
Slot 3 Reserved 0x00000000
M3 Autotest Disabled
C-link Status Disabled
Independent Firmware Recovery Disabled
EPID Group ID 0x1FB3
LSPCON Ports None
5K Ports None
OEM Public Key Hash FPF 0000000000000000000000000000000000000000000000000000000000000000
OEM Public Key Hash ME 0000000000000000000000000000000000000000000000000000000000000000
ACM SVN FPF 0x0
KM SVN FPF 0x0
BSMM SVN FPF 0x0
GuC Encryption Key FPF 0000000000000000000000000000000000000000000000000000000000000000
GuC Encryption Key ME 0000000000000000000000000000000000000000000000000000000000000000

FPF ME
--- --
Force Boot Guard ACM Disabled Disabled
Protect BIOS Environment Disabled Disabled
CPU Debugging Enabled Enabled
BSP Initialization Enabled Enabled
Measured Boot Disabled Disabled
Verified Boot Disabled Disabled
Key Manifest ID 0x0 0x0
Enforcement Policy 0x0 0x0
PTT Enabled Enabled
PTT Lockout Override Counter 0x0
EK Revoke State Not Revoked
PTT RTC Clear Detection FPF Not set

Intel(R) MEManuf Version: 11.8.50.3425
Copyright(C) 2005 - 2017, Intel Corporation. All rights reserved.

Windows OS Version : 10.0

FW Status Register1: 0x90000245
FW Status Register2: 0x06F60506
FW Status Register3: 0x00000020
FW Status Register4: 0x00084000
FW Status Register5: 0x00000000
FW Status Register6: 0x40000000

CurrentState: Normal
ManufacturingMode: Disabled
FlashPartition: Valid
OperationalState: CM0 with UMA
InitComplete: Complete
BUPLoadState: Success
ErrorCode: No Error
ModeOfOperation: Normal
SPI Flash Log: Not Present
Phase: ROM/Preboot
ICC: Valid OEM data, ICC programmed
ME File System Corrupted: No
PhaseStatus: AFTER_SRAM_INIT
FPF and ME Config Status: Match

FW Capabilities value is 0x31111540
Feature enablement is 0x11111140
Platform type is 0x71220322
No Intel Wireless device was found
Feature enablement is 0x11111140
ME initialization state valid
ME operation mode valid
Current operation state valid
ME error state valid
OEM ICC data valid and programmed correctly
MFS is not corrupted
PCH SKU Emulation is correct
FPF and ME Config values matched

Request Intel(R) ME BIST status command... done

Get Intel(R) ME test data command... done

Get Intel(R) ME test data command... done
Total of 10 Intel(R) ME test result retrieved

Policy Kernel - Boot Guard : Self Test - Passed
MCA - MCA Tests : Blob - Passed
MCA - MCA Tests : MCA Manuf - Passed
SMBus - SMBus : Read byte - Passed
VDM - General : VDM engine - Passed
PAVP - General : Verify Edp and Lspcon Configurations - Passed
PAVP - General : Set Lspcon Port - Passed
PAVP - General : Set Edp Port - Passed

Clear Intel(R) ME test data command... done

MEManuf Operation Passed

reply

Repair MEI on Samsung NP550P7C-S04PL � � Strange ME Region size mismatch after reconfiguring and rebuilding

Page 247 of 380 � Page 1 ... 242 243 244 245 246 247 248 249 250 251 ... 380 Page �

Please enter a reason for warning.