Intel Converged Security and Management Engine (Intel CSME) Security Updates

[Lalo16]

I ran the CSME Version Detection Tool provided by Intel. Please see below for results:

Intel(R) CSME Version Detection Tool
Copyright(C) 2017-2024, Intel Corporation, All rights reserved.

Application Version: 11.0.4.0
Scan date: 2024-07-22 23:25:20 GMT

*** Host Computer Information ***
Manufacturer: HP
Model: HP Spectre x360 Convertible
Processor Name: Intel(R) Core(TM) i7-7500U CPU @ 2.70GHz
OS Version: Ubuntu 24.04 LTS (6.8.0-38-generic)

*** Intel(R) ME Information ***
Engine: Intel(R) Converged Security and Management Engine
Version: 11.8.50.3470

*** Risk Assessment ***
Based on the analysis performed by this tool: This system is vulnerable.
Explanation:
The detected version of the Intel(R) Converged Security and Management Engine firmware
has a vulnerability listed in one or more of the public Security Advisories.
Contact your system manufacturer for support and remediation of this system.

For more information refer to the Intel(R) CSME Version Detection Tool User Guide
or the related Intel Security Advisory list at:
https://www.intel.com/content/www/us/en/support/articles/000031784/technologies.html

This is the latest update I am seeing in HP:
https://support.hp.com/us-en/drivers/swdetails/hp-spectre-13-w000-x360-convertible-pc/model/13443276...

Is there any security package available to resolve this vulnerability? If not is there an estimated time of when HP will make one available?

[banhien]

@Lalo16 

Please use new update from Intel

           https://www.intel.com/content/www/us/en/support/articles/000025619/software.html

Regards.

[Lalo16]

Hi Banhien,

Thank you for taking the time to provide me with support.

I reviewed the link you sent me and I this what Intel states:

"Intel has provided system and motherboard manufacturers with the necessary firmware and software updates to resolve the vulnerabilities identified in Security Advisory Intel-SA-00086.

Contact your system or motherboard manufacturer regarding their plans for making the updates available to end users."

I checked the following list of available updates in HP using the source below and the latest one I was able to see is sp100251 and  sp111954

https://support.hp.com/us-en/drivers/hp-spectre-13-w000-x360-convertible-pc/model/13443276

Installing sp100251 updating the version to 11.8.70.3626

I reran the Intel CSME Version Detection Tool provided by Intel and this was the output:

** Host Computer Information ***
Manufacturer: HP
Model: HP Spectre x360 Convertible
Processor Name: Intel(R) Core(TM) i7-7500U CPU @ 2.70GHz
OS Version: Ubuntu 24.04 LTS (6.8.0-38-generic)

*** Intel(R) ME Information ***
Engine: Intel(R) Converged Security and Management Engine
Version: 11.8.70.3626

*** Risk Assessment ***
Based on the analysis performed by this tool: This system is vulnerable.
Explanation:
The detected version of the Intel(R) Converged Security and Management Engine firmware
has a vulnerability listed in one or more of the public Security Advisories.
Contact your system manufacturer for support and remediation of this system.

For more information refer to the Intel(R) CSME Version Detection Tool User Guide
or the related Intel Security Advisory list at:
https://www.intel.com/content/www/us/en/support/articles/000031784/technologies.html

Intel mentions to contact HP, but I do not see any more recent updates that the ones the make available in https://support.hp.com/us-en/drivers/hp-spectre-13-w000-x360-convertible-pc/model/13443276.

Do you have any other suggestions to resolve the vulnerabilities flagged by the Intel CSME Version Detection Tool?

Thanks

[teoberi]

Where did you find the Intel(R) CSME Version Detection Tool version:

Intel(R) CSME Version Detection Tool
Copyright(C) 2017-2024, Intel Corporation, All rights reserved.

Application Version: 11.0.4.0

Intel's website says:
Intel® Converged Security and Management Engine Version Detection Tool (Intel® CSMEVDT)
id
19392
data
4/8/2024
Version
10.0.0.0 (Latest)

Solved!
When downloading, the correct version appears!😀