search

intel / Intel-Linux-Processor-Microcode-Data-Files

Other
620 stars 68 forks source link

INTEL-SA-00528 mitigation ucodes #57

Open l00k opened 2 years ago

l00k commented 2 years ago

https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00528.html I don't see updated ucodes which mitigate this issue. Is database up to date?

andyhhp commented 2 years ago

Intel-SA-528 protections are not runtime loadable, hence not included here.

You need a full firmware update from your OEM to mitigate the security issue.

l00k commented 2 years ago

@andyhhp thank you for fast answer. I understand but I was using ucodes from this repository to build modified BIOS and flash it 2-3 months before official BIOS release. Any chance to get it? I really need it cuz SGX now fails while performing Remote attestation.

hmh commented 2 years ago

Either Intel managed to change them to be runtime loadable, or a subset of such updates are supposed to be runtime loadable. The latest release (20220207) has fixes for INTEL-SA-00528...

It is also possible that the full fix requires a firmware update, and early-loading is a partial fix. It would be nice to get either a confirmation that "the new set of updates fully addresses INTEL-SA-00528" from Intel, or a confirmation that one should still pester the hardware vendor to get a proper firmware update to get the full fix, because the O.S. microcode update cannot fix the whole issue.

whpenner commented 2 years ago

The mitigation for INTEL-SA-00528 must be loaded at BIOS (at FIT) to be effective. @l00k Those MCUs are now available with the release earlier this week.

l00k commented 2 years ago

Thx for info I have already extracted it from one of official releases I understand for future updates MCU will be not saved in this repo?

whpenner commented 2 years ago

I'm not aware of any changes being planned for this repo, at this point. Where did you hear that future updates wouldn't be here?

l00k commented 2 years ago

Maybe I expressed wrongly. I asked about future MCU updates (non runtime loadable) - will it be included here? This one which I have mentioned in first post was not included here

whpenner commented 2 years ago

We generally won't move non-runtime loadable MCUs if there isn't a good reason to. If we are updating many MCUs, then we do try to update everything to the latest publicly available MCU. In this case for the three INTEL-SA-00528 affected products, we choose not to publish those since there was no value for OS loading and we didn't want to trigger Linux distros to do unnecessary work. I understand that you were taking the MCUs and "stitching" them into your BIOS and there was value from doing that. Let me see if we can find a way to handle this.