en.wikipedia.org/wiki/Intel_Management_Engine
2 corrections found
The ME has its own MAC and IP address for the out-of-band management interface
This is too absolute. Intel’s own AMT documentation says the management interface can share the host system’s MAC address and can also share the host’s IPv4 address, so it does not always have separate MAC/IP addresses.
Full reasoning
Intel’s documentation for AMT_EthernetPortSettings explicitly includes a SharedMAC property, defined as: “Indicates whether Intel(R) AMT shares its MAC address with the host system.” The same class also defines SharedStaticIp and SharedDynamicIP, which indicate whether the host IP address is shared with ME.
Intel’s network-configuration guide goes further and states that Intel AMT supports shared IPv4 addressing modes: “Intel AMT and the host have a shared dynamic IP address (IPv4 only),” and “Starting with Release 7.0, Intel AMT and the host can share a static IP address (IPv4 only, wired).”
So the article’s wording is incorrect as written: the management interface does not always have its own MAC and IP address. Depending on configuration and platform, Intel AMT/ME may use dedicated addresses or shared ones.
2 sources
- AMT_EthernetPortSettings
SharedMAC — Indicates whether Intel(R) AMT shares it's MAC address with the host system. ... SharedStaticIp — Indicates whether the static host IP is shared with ME. ... SharedDynamicIP — Indicates whether the dynamic host IP is shared with ME.
- Detailed Description
Intel AMT and the host have a shared dynamic IP address (IPv4 only). ... Starting with Release 7.0, Intel AMT and the host can share a static IP address (IPv4 only, wired).
Every Intel platform with provisioned Intel Standard Manageability, Active Management Technology, or Small Business Technology, from Nehalem in 2008 to Kaby Lake in 2017 has a remotely exploitable security hole in the ME.
This overstates SA-00075. Intel’s advisory says the remote network exploit applied to AMT and ISM, but explicitly says Intel Small Business Technology was not vulnerable to that first, remote issue.
Full reasoning
Intel’s own SA-00075 advisory says there were two access paths for CVE-2017-5689, and it explicitly separates them.
Intel states: “There are two ways this vulnerability may be accessed please note that Intel® Small Business Technology is not vulnerable to the first issue.” It then defines the first issue as a network attack against provisioned Intel AMT and Intel Standard Manageability systems. Intel lists Small Business Technology only under the second, local-provisioning issue.
So the Wikipedia sentence is incorrect because it says all provisioned platforms with AMT, ISM, or SBT had a remotely exploitable hole. According to Intel, SBT was not affected by the remote network vector described in the first issue.
2 sources
- INTEL-SA-00075
There are two ways this vulnerability may be accessed please note that Intel® Small Business Technology is not vulnerable to the first issue. An unprivileged network attacker could gain system privileges to provisioned Intel manageability SKUs: Intel® Active Management Technology (AMT) and Intel® Standard Manageability (ISM).
- INTEL-SA-00075
An unprivileged local attacker could provision manageability features gaining unprivileged network or local system privileges on Intel manageability SKUs: Intel® Active Management Technology (AMT), Intel® Standard Manageability (ISM), and Intel® Small Business Technology (SBT).