Librem Hardware and the Intel CSME Vulnerability

Firmware and BIOS, Hardware / / /
Purism

Purism

Beautiful, Secure, Privacy-Respecting Laptops, Tablets, PCs, and Phones
Purism

Latest posts by Purism (see all)

Whenever a security vulnerability comes out one of the first questions that come to many peoples’ minds is: am I affected? The last couple of years in particular have seen a lot of hardware-based vulnerabilities in Intel processors and in those cases generally it’s a matter of looking at the affected list of hardware and comparing it against your own hardware.

More recently a vulnerability (CVE-2019-0090) was announced in the Intel CSME that can allow an attacker with local access to potentially extract secret Intel hardware signing keys from a system. There are a number of different analyses out there on this vulnerability from the very dry CVE report itself to “sky is falling” reports that contain a lot more hype. If you want more technical details on the vulnerability itself, I’ve found this report to have a good balance of measured technical information on impact without the hype.

But is Librem Hardware Affected?

We’ve gotten a lot of questions recently about whether Librem hardware is affected by this vulnerability, given that the CVE includes a wide range of hardware (including chips in our own systems). After looking into the issue we feel confident in answering that Librem Intel-based computers (our laptops, servers, and the new Librem Mini) are not affected by CVE-2019-0090, due to how we use (and don’t use) the ME. Beyond that, PureBoot users will have extra protection including the ability to detect someone attempting to exploit this vulnerability.

The reason our hardware isn’t vulnerable to this ME vulnerability is similar to why we haven’t been vulnerable to past ME exploits like a recent AMT vulnerability. For starters, we disable and neutralize the ME to remove all but the most essential modules, which for past exploits (such as AMT vulnerabilities) has meant there was nothing to exploit. For CVE-2019-0090, the attack is against a core and fundamental module we do include, however because we do not use Intel hardware signing keys for root of trust at all, it attacks features we don’t use.

Extra Protection with PureBoot

Since this attack exploits features we don’t use, customers who use our default coreboot firmware don’t have anything to worry about, and customers who use our PureBoot firmware have an extra level of protection including detecting the exploit. This is because the contents of the ME is part of the PureBoot firmware image and is among the things that PureBoot tests for tampering. Someone who could modify the ME with an exploit would trigger a PureBoot alert the next time the user turns on the computer.

Thanks

It’s been encouraging to see how many of our customers are informed on and concerned with the latest security issues out there. I hope this brief explanation helps you understand why our unique approach to security also often offers us special immunity to common security issues.

Recent Posts

Related Content

Tags

Advanced readers AweSIM Battery life Boot and BIOS Chipsets and components CISO Communications infrastructure Consumer Privacy Crowdfunding Customer Feedback cybersecurity Enterprise FLOSS applications Giving and contributing back Graphics infosec Laptops Liberty Phone librem 5 Librem 5 USA Librem 14 Linux kernel Made in USA Electronics most secure computer most secure laptop most secure pc most secure phone Newsletter and status updates Phones Press Privacy Product or service launch PureOS secure computing Secure Supply Chain Security Software freedom Supply chain Testimonials and user stories Tips and tricks User empowerment User experience design User interaction design Videos Website
Purism

3D renders are artist renderings, for illustration purposes. Images and specifications are subject to change depending on manufacturing requirements.

Unless otherwise noted, contents created by the Purism team on this website are copyleft with a CC-by-SA 4.0 license.