Apple left Intel processor management and testing tools unlocked for years

An exploration of an Intel chipset function known as the Management Engine revealed Apple failed to lock down an undocumented feature until the last High Sierra patch, a vulnerability that could grant a skillful attacker the ability to write data to the RAM of a Mac if left unchecked.

The Intel Management Engine (ME) is a subsystem used to handle tasks during the booting process and in the background, and has been in use since 2008. The Register reports the investigation by security firm Positive Technologies looked into how the subsystem could be abused, as a "side-channel threat" to the processor.

Researchers Maxim Goryachy and Mark Ermolov, who previously were involved in the finding of a related Intel ME firmware flaw one year ago, posted on Tuesday about their latest discovery. In this case, it was about an undocumented feature of Intel ME called Manufacturing Mode, which is meant to ease the manufacturing process for device vendors.

"Intel ME Manufacturing Mode is intended for configuration and testing of the end platform during manufacturing, and as such should be disabled (closed) before sale and shipment to users," the researchers state, before noting that the mode's existence and potential risks surrounding it were not provided in Intel's publicly-available documentation.

The software used to access Manufacturing Mode is part of the Intel ME System Tools. The application is provided to device vendors like Apple to use during the production process, but it is not available to the general public. Ermolov and Goryachy both believe Intel are putting users at risk by not providing public documentation for its technology, including attacks that could result "in data theft, persistent irremovable rootkits, and even 'bricking' of hardware."

Manufacturing Mode is intended to configure platform settings via Field Programming Fuses (FPF), a form of "one-time programmable memory," before shipping. Manufacturing Mode can also specify settings for Intel ME, stored in its own internal file system on Serial Peripheral Interface (SPI) flash memory, in parameters called CVARs (Configurable NVARs, Named Variables.)

The process of setting FPFs is in two steps, with the first being defining the values, possible only under Manufacturing Mode and are saved to temporary memory. The second step, the committing of the FPF values to the Fuses, only occurs when Manufacturing Mode is closed, meaning they are able to be changed at a later date if the mode isn't disabled.

For earlier chipsets used before Apollo Lake, Intel separated out the access rights for the CPU, Gigabit Ethernet, and the Management Engine. If one was compromised, the others are not necessarily affected.

In newer chipset versions, the SPI controllers include what is known as a "Master Grant," which can override any existing access rights in an SPI descriptor, across all elements. In short, if Manufacturing Mode is unlocked, it is possible for an attacker to work around any blocked access to an SPI memory region, simply by changing the configuration.

In turn, this would allow the attacker to write their own data into the now-accessible sections.

In their research, the analysts tested notebooks from Lenovo and Apple, and found that Manufacturing Mode was still accessible in the MacBook Pro, indicating Apple had failed to disable the feature. The Yoga and ThinkPad notebooks from Lenovo did not have any Manufacturing Mode issues.

The researchers reported their findings of the vulnerability, identified as CVE-2018-4251, to Apple earlier this year. A patch was produced and included in the macOS High Sierra 10.13.5 update in June.

Apple's support page describes the patch as relating to Firmware, stating "A malicious application with root privileges may be able to modify the EFI flash memory region," and that "a device configuration issue was addressed with an updated configuration."

To end users, there is little to do other than to keep macOS up to date, and if they had not applied the patch in question, to do so soon.

The news of the vulnerability is the latest in a long line of Intel-related security issues that have plagued the company over the last year. In January, the Spectre and Meltdown fiasco involved security holes in the processors that granted access to protected kernel memory data, with fixes for the design flaws hampering performance for some users.

A second wave of Spectre-style security flaws were found in May, stemming from the same design-related issues. More recently, the Foreshadow vulnerability was found to attack Secure Guard Extensions (SGX), which allowed for an attacker to read protected user data from a supposedly secure section of the chip's onboard memory.