Intel CSME, previously known as the Intel Management Engine BIOS Extension (Intel MEBx), is a security feature that’s the basis for cryptography in CPUs and firmware. It’s similar to the infamous Spectre and Meltdown vulnerabilities discovered several years ago, in that one of the only successful fixes was to physically replace the hardware.
#What is intel management engine bios extension v3.0.2.004 Patch
It has now emerged this patch only addressed one potential attack vector, involving the Integrated Sensors Hub (ISH), and the root vulnerability goes much deeper. These include CSME-ready chips with SPS firmware for servers, TXE firmware for tablets or low-power devices, DAL software for machines ranging from workstations to IoT devices, and the AMT module used for remote IT management.Īssigned CVE-2019-0090, it was actually first flagged as a highly-severe flaw in May 2019, with Intel releasing a patch to fix what was at the time thought to be a mere firmware bug. The range of devices afflicted is very broad, according to Intel. The vulnerability is so serious that Intel has advised affected customers to replace hardware in order to fix it.
![what is intel management engine bios extension v3.0.2.004 what is intel management engine bios extension v3.0.2.004](http://users.wfu.edu/yipcw/lenovo/t400/intel-amt-mebx/images/intel-amt-mebx-password-invalid.gif)
The vulnerability also allows an attacker to conduct arbitrary code execution with zero-level privileges within the Intel CMSE.
![what is intel management engine bios extension v3.0.2.004 what is intel management engine bios extension v3.0.2.004](https://i1.wp.com/www.techarp.com/wp-content/uploads/2016/09/BIOS-Guide-Vanderpool-Technology.jpg)
Exploitation could allow an attacker to extract the CPU’s chipset encryption key and compromise the root of trust in a system, according to research published with Positive Technologies.