Intel April advisories: more info

Today we released a technical whitepaper concerning CSME and CVE-2019-0090 along with 6 security advisories.https://t.co/qOQWXQ17RX

— Jerry Bryant (@jnabryant) April 14, 2020

[1/3] Intel has published 15 pages about CVE-2019-0090 [see: https://t.co/2xQS13mT0j].
In my opinion, this document can give a false sense of security:
1. For attack we did NOT use Intel-SA-00086; pic.twitter.com/nRHFIDZZjT

— Maxim Goryachy (@h0t_max) April 14, 2020

[2/3]
2. Hardware based Anti-rollback isn't protected again vulnerabilities in ROM;
3. Attacker can be exploited this issue, not only through ISH (it is confirmed by Intel engineers); pic.twitter.com/UTuEY7j1m7

— Maxim Goryachy (@h0t_max) April 14, 2020

[3/3]
4. Key may be extracted because we have code execution BEFORE erasing keys and in some version of ME attacker can re-calculate keys for new SVN;
5. Table Impact of "Impact CVE…" looks like facts manipulations to me because this issue not related with CVE-2017-5705/7. pic.twitter.com/w5A4Tsn5ll

— Maxim Goryachy (@h0t_max) April 14, 2020