Closed dnoliver closed 4 years ago
What's the contents of cat /sys/class/mei/mei0/fw_ver
please?
$ cat /sys/class/mei/mei0/fw_ver
0:3.1.55.2269
0:3.1.55.2269
0:3.1.55.2270
My device does not have Intel Management Engine
Are you sure? That looks like CSME to me. And a vulnerable CSME at that...
The manufactured confirmed that I have a TXE, an insecure one :)
They confirmed that the test is correctly checking for the TXE version, and reporting it as the MEI version.
On their opinion, for this platform, the MEI test should be named as TXEI test.
Ahh, TXE indeed. Never do bitshifts in your head :) Isn't MEI the name for the superset group of (SPS,TXE,ME and CSME)?
According to the expert I could find in this topic, the MEI is the name of the linux interface to communicate with the the engine (which can be, TXE, CSME, ME, etc).
It is true that the MEI is used to communicate with the TXE then. But I don't think it is the name of the engines superset.
But I don't find any name that could group them all :)
So, if it is not going to say "TXE version" or "CSME version" depending on what that platform is using, I believe that MEI version could be acceptable. The only problem that I have is people thinking that they have a vulnerable ME, when they actually have a vulnerable TXE.
@superm1 got any ideas? I guess we could split up FWUPD_SECURITY_ATTR_ID_MEI_VERSION
into FWUPD_SECURITY_ATTR_ID_TXT_VERSION
, FWUPD_SECURITY_ATTR_ID_CSME_VERSION
and all the others but it seems like a lot of work. Got any other ideas about a term for the superset?
How about MEI reported version?
How about MEI reported version
I don't know if people just know what MEI is. Isn't MEI just the reporting mechanism rather than the superset? Maybe ME/TXE/CSME version
?
How about Intel platform security core
to get a superset?
Intel Security Coprocessor Version? Intel Platform Security Coprocessor Version?
Looks great now!
With TXE:
[test@compulab-fitlet2-1181004-04904 ~]$ rpm -qa fwupd
fwupd-1.5.0-0.601.20200701git.fc32.x86_64
[test@compulab-fitlet2-1181004-04904 ~]$ fwupdmgr security --force
Host Security ID: HSI:1 (v1.5.0)
HSI-1
✔ SPI BIOS region: Locked
✔ SPI lock: Enabled
✔ SPI write: Disabled
✔ TPM v2.0: Found
✔ TXE manufacturing mode: Locked
✔ TXE override strap: Locked
✔ TXE v0:3.1.75.2351: Valid
✔ UEFI dbx: Found
With CSME:
[test@dnoliver-nuc1 ~]$ fwupdmgr security --force
Host Security ID: HSI:0 (v1.5.0)
HSI-1
✔ CSME manufacturing mode: Locked
✔ CSME override strap: Locked
✔ SPI BIOS region: Locked
✔ SPI lock: Enabled
✔ SPI write: Disabled
✔ TPM v2.0: Found
✔ UEFI dbx: Found
✘ CSME v0:11.8.60.3561: Invalid
Describe the bug A clear and concise description of what the bug is.
My device does not have Intel Management Engine (ME), hence it does not support Intel Active Management Technology (AMT). Running the
fwupdmgr security --force
command tells me that my HSI is 0 because the MEI Version is invalid.I have compiled and executed the https://github.com/mjg59/mei-amt-check tool to do some debugging, and this is what it tells me:
My questions are:
/dev/mei0
device present for some reason. Is that what is causing the MEI version to be inspected?Steps to Reproduce Steps to reproduce the behavior.
On a device using Intel TXT (or Intel CSME), run the
fwupdmgr security --force
command. MEI version will be displayed as invalid.Expected behavior A clear and concise description of what you expected to happen.
I would expect not seeing MEI Version. Or I would expect seeing the Intel TXT version (which also have some CVEs there to solve)
fwupd version information Please provide the version of the daemon and client.
Please note how you installed it (
apt
,dnf
,pacman
, source, etc):fwupd device information Please provide the output of the fwupd devices recognized in your system.
Additional questions