Surface Studio Vulnerable to INTEL-SA-00086 Critical Security Vulnerability - Requires Microsoft to Issue a Firmware Update - How Long?

Anonymous
2017-11-21T00:42:36+00:00

Intel released a disclosure today on a series of vulnerabilities in their management engine and trusted execution engine, affecting Surface Studio (and presumably other Surface devices). 

https://security-center.intel.com/advisory.aspx?intelid=INTEL-SA-00086&languageid=en-fr

They included a tool to check to see if your system is vulnerable:

http://www.intel.com/sa-00086-support

I've run the tool on a Surface Studio and confirmed that is vulnerable and requires Microsoft to issue a firmware update with the patch Intel provided. As they have presumably already given the patch to you, I'm wondering how long you're going to leave us all vulnerable to this before you release the required firmware update to patch this?

We need this fixed ASAP!

Surface | Surface Studio | Safety and security

Locked Question. This question was migrated from the Microsoft Support Community. You can vote on whether it's helpful, but you can't add comments or replies or follow the question.

0 comments

20 answers

Sort by: Newest
Most helpful Newest Oldest
  1. Anonymous
    2017-11-28T08:47:02+00:00

    I'm pretty sure that SP4 and anything released after SP4 is vulnerable.

    True = I have a surface laptop that's vurnable as well.

    Just want to point out this is not just a vurnability anymore their is an existing exploit for this and parts of this will be presented at Blackhat UK 2017 06-12-17. I really hope Microsoft puts out a patch before that.

    The best solution would be to disable Intel ME completly :-)

    https://www.blackhat.com/eu-17/briefings/schedule/#how-to-hack-a-turned-off-computer-or-running-unsigned-code-in-intel-management-engine-8668

    Was this answer helpful?

    0 comments
  2. Anonymous
    2017-11-27T19:55:40+00:00

    Same issue on my Surface pro 4 but not on my Surface 3 as mentioned here. Can the ME be disabled without affecting usual usage of Surface 4 pros?

    Was this answer helpful?

    0 comments
  3. Anonymous
    2017-11-23T23:16:18+00:00

    My Surface Pro 4 was found to be vulnerable as well. When will we get a fix for this vulnerability? Other major PC manufactures have a software patch in the works to be released soon on their PC lines and I would think Microsoft would be right there with them. I bought a Surface Pro because I thought it was a superior tablet but if you don't back it to fix major security vulnerabilities found in the software or hardware used by your products then it is not better then the competition.

    We need a fix Microsoft and we we need it ASAP!

    Was this answer helpful?

    0 comments
  4. Barb Bowman 80,805 Reputation points MVP Volunteer Moderator
    2017-11-22T13:06:54+00:00

    I'm pretty sure that SP4 and anything released after SP4 is vulnerable.

    Was this answer helpful?

    0 comments
  5. Anonymous
    2017-11-22T00:59:27+00:00

    Just ran the tool on a Surface Pro 4 and it was found to be vulnerable as well.

    Was this answer helpful?

    0 comments