-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 On Tue, 2017-11-28 at 15:19 +0000, Paul Groves wrote:

On 28/11/17 15:08, Christopher Myers wrote:

...

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512

I ran Intel's IME firmware bug detection tool on my Lenovo T570 today, and it said that my laptop is vulnerable and to contact my vendor. So I went to Lenovo's website and found patches...for Windows only. I'm going to bet that Lenovo won't release Linux patches, or bootable CDs with firmware patches, etc.

Out of curiosity, how are others addressing things like this? Do I really have to swap out my hard drive with a Windows version to install the patch, and then revert back to my nice safe Linux home afterwards? -----BEGIN PGP SIGNATURE-----

iQEzBAEBCgAdFiEE7GM/Dul8WSWn72odQ1nEo4DFCIUFAlode84ACgkQQ1nEo4DF CIUyAgf/eN/8zHeQVUqtrDgovckKz0QR9elBfgQKkLK/pVzeTpC9GKtKGzj7uNN+ RxTVc3Rdj0WzcoU7VfgvxAXj14B5TOpG/zEwdtPd5m1HtcvRPxOHYFQllGzKJgPx p5zF0gQ8TElLnskkO94AQDU0OAL/usgwqWtvPvu0nzS3EVr9NnezIdflxtsYLIDD Hhf+AwL6X1DfkEO7WsWFP5jEZU9KatfHgT9UP5msPU76Hk17b/ZSNX0GrO1vHNdk BPU+BJYNYlo5KvvSkk9pHz+t65H9l7iFNdh0rRjGxepmjDATdGKOWQOHbq+EQag4 991GWaYrrDG7rXq+JTglL6fkqg/LBQ== =N7ib -----END PGP SIGNATURE----- N�����r��y隊Z)z{.�ﮞ˛���m�)z{.��+�:�{Zr�az�'z��j)h���Ǿ� ޮ�^�ˬ z�

I remember doing one on an old Intel Q35 chipset board.

Check in the BIOS which IME you have and download the patch from Intel. Sometimes they have linux support and sometimes DOS support so you can use a bootable USB. Make sure you don't try to install the wrong firmware because if you do, you're gonna have a bad time!

I found this interesting.

https://www.theinquirer.net/inquirer/news/3019569/purism-disables-int els-management-engine-on-linux-powered-laptops

I do like the idea of being able to run a laptop that doesn't have the backdoor enabled, but unfortunately work won't let us go that route (we've standardized on specific models.) In this case, Intel's not releasing firmware directly unfortunately :/ https://www.intel.com/content/www/us/en/support/articles/000025619/soft ware.html Why can’t Intel provide the necessary update for my system? Intel is unable to provide a generic update due to management engine firmware customizations performed by system and motherboard manufacturers. -----BEGIN PGP SIGNATURE----- iQEzBAEBCgAdFiEE7GM/Dul8WSWn72odQ1nEo4DFCIUFAlodg3AACgkQQ1nEo4DF CIWB4AgAlA56raruR6Hk7K2odNS3yUPbBAUy36tx8QJyJYf+r9sPm5bZvcSyw2No FuylT6dR3uG9xQeugClHDL+zOGRHBLWo07W+CbbjzJ59Xg/cH4z9PAEPYgx7R77Y 2v2coGDvOJ71tdUqC+UehhroeHWh9feOGI599vmUT+yyrGqORGO6m4GB5Zn5Z1ag aNHsxYbnyhDxOHRpvztCx24bF0bYJvF+fwerbGxQT3+Kd42fGb2/8EMZhOWBSIlH XMr798/r2RvV2A69n7ioZRsaKOmbSkgd4Cmr0XRXYgYe3qSmWO6nj5dvhVS3cE0E 48p4RlKBhm+EWOmsbhVvj1zIljdtcQ== =qMJZ -----END PGP SIGNATURE-----

Den 2017-11-28 kl. 17:14, skrev Per Jessen:

Christopher Myers wrote:

...

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512

I ran Intel's IME firmware bug detection tool on my Lenovo T570 today, and it said that my laptop is vulnerable and to contact my vendor. So I went to Lenovo's website and found patches...for Windows only. I'm going to bet that Lenovo won't release Linux patches, or bootable CDs with firmware patches, etc. For BIOS updates of Thinkstations and Thinkcentres, I have definitely downloaded bootable CDs in the past.

Yes. That's how I do it on my X1 yoga. Christopher, Is it this you're looking for? https://pcsupport.lenovo.com/us/sv/downloads/ds120370 -- /bengan -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org To contact the owner, e-mail: opensuse+owner@opensuse.org

On Nov 28, 2017, at 15:27:08, Peter Suetterlin wrote:

Christopher Myers wrote:

...

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512

I ran Intel's IME firmware bug detection tool on my Lenovo T570 today, and it said that my laptop is vulnerable and to contact my vendor.

yes, same issue on my T460p :(

...

So I went to Lenovo's website and found patches...for Windows only. I'm going to bet that Lenovo won't release Linux patches, or bootable CDs with firmware patches, etc.

I'm not sure how/if the IME is 'part of the BIOS'. One possible thing would be that the current IME fix is really a hotfix, and that a more general BIOS update (that also brings this IME update) will show up at a later point. BIOS updates do work as they supply CD images that you can use to create a USB boot stick (done that twice so far in 15 months).

...

Out of curiosity, how are others addressing things like this? Do I really have to swap out my hard drive with a Windows version to install the patch, and then revert back to my nice safe Linux home afterwards?

Well, I don't even have any windows around that I could use. For now I'll wait for the next BIOS update and see what happens then...

Try this download page: https://pcsupport.lenovo.com/us/en/downloads/DS120370 There there is a bootable CD image which you should be able to convert to a bootable USB stick. The mechanics of getting a bootable CD ISO on to a bootable USB stick I would need to research. I'm sure someone here would know the answer to the latter issue, -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org To contact the owner, e-mail: opensuse+owner@opensuse.org

Tom Kacvinsky wrote:

Try this download page:

https://pcsupport.lenovo.com/us/en/downloads/DS120370

Well, that's for a different laptop, and even more important, the date of the download is 13/10/2017. The IME updates were only rolled out mid november IIRC, so I doubt that BIOS update would fix the IME issue...

There there is a bootable CD image which you should be able to convert to a bootable USB stick. The mechanics of getting a bootable CD ISO on to a bootable USB stick I would need to research. I'm sure someone here would know the answer to the latter issue,

That's the easier part, you need geteltorito (from the geniosoimage package), geteltorito -o bios.img r07uj17wd.iso (or whatever your bios iso is called) and write that bios.img to a usb medium (using cat or dd) -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org To contact the owner, e-mail: opensuse+owner@opensuse.org