This was 2 weeks ago.
Are there any updates on this? When can we expect the update? Is it still a long way to go?
3 Likes
Just got to be patient. As Kieran mentioned, theyâre still doing validation on the bios build. Better they take the time to properly validate it than to rush out a bios that could brick your laptop or some functionality.
1 Like
Is there anything wrong in my wording? I am just asking for an update. People are waiting for this.
1 Like
Thereâs a lot going on in the background and theyâll provide an update when theyâre ready to release it. Something to remember is they contract out bios work to Insyde so things can take a while.
1 Like
For anyone curious about timelines, Before this update 3.06 was released as beta, we had a comment from Kieran roughly about 2 months before, about this update being in the works. I believe it was after FW announced thunderbolt 4 certification for 12th gen.
Point is, even if kieran want to get a new bios version out, we are looking at similar time frame.
I understand, waiting sucks, Iâve been daily driving this beta release for 6+ months. Unfortunately FW is still a small company. I would like FW to exist in 5 years, so letâs give them the room to grow reasonably.
6 Likes
Having trouble finding consistent info on the topic, what should our retimer versions be? Iâve noticed that I have to reseat my type a and Ethernet expansion card on boot for them to work.
Thank you very much, now I have a rough guestimate (all I wanted) 
1 Like
Framework 16 just opened for preorders so I assume theyâre very busy right now
Theyâre working on fixing a fingerprint reader bug on the 13th gen too. IMO though, the vulnerabilities in the 12th gen should be much higher priority than a fingerprint reader malfunction.
Maybe Iâm out of touch since I donât work in this industry, but active vulns are never left unaddressed for longer than 90 days max in my industry (and are normally patched within hours).
4 Likes
Seems to me like itâs been about a year since 12th gen came out and we have not received any âcompleteâ/official updates (only this beta). Going forward I am keeping a close eye on how they plan to support the newer 13" and the 16" before I consider purchasing anything Framework. With respect to the promisees we keep getting, the saying âFool Me Once, Shame on You; Fool Me Twice, Shame on Meâ comes to mind.
8 Likes
I donât know if I missed something, but the Software Center in Fedora 38 on a 12th Gen offers me an update. But actually the update is not released yet, right? 
Is there a way I can prevent the update (Iâm new to Fedora, used to run Ubuntu till recently)?
1 Like
Sure its not just the SecureBoot dbx update?
According to LVFS: Home the only updates hosted at this time are those we know about and marked as Beta/Testing.
2 Likes
You might have the lvfs testing repo enabled.
3 Likes
Out of curiosity, I went through all the vulnerabilities mentioned in the top post here.
Almost all of them are about privilege escalation from ring 0 to ring -2, which means that code running in the kernel (eg. device drivers) can exploit the vulnerability to elevate privileges into system management mode (SMM). Practically, these sort of vulnerabilities arenât terribly critical for end-users, because they already require a deeply compromised system that is running malware in the kernel.
2 vulnerabilities are different, though:
CVE-2022-35897 can only be exploited during boot and requires physical access to the machine. This sort of attack is only relevant for very niche threat models and so also doesnâ't seem like a realistic concern for most users.
CVE-2022-36337 looks somewhat worse than all the other vulnerabilities, since it is potentially exploitable from ring 3:
An attacker with local privileged access can exploit this vulnerability to elevate privileges from ring 3 or ring 0 (depends on the operating system) to a DXE Runtime UEFI application and execute arbitrary code.
It sadly doesnât include much detail beyond that, but âring 3â is where all user applications run, so it is more accessible to malware than ring 0. It does mention âprivileged accessâ, which I understand as root/Administrator privileges, so presumably not every application can do it. It also doesnât mention which OS allows exploitation from ring 3, unfortunately.
Ultimately though, exploiting this vulnerability would still at the very least seem to require the user to run specially crafted malware as root or with Administrator privileges, so if you take the usual precautions, this is also not something to worry about, usually.
All that said, there is absolutely no situation in which leaving 9 vulnerabilities in your firmware unpatched for half a year after public disclosure is in any way a good look. I am sure Framework understands this, but it is still sad to see, small company or not. (itâs entirely possible that the reason the progress has been so slow is due to Insyde or Intel taking their sweet time, but the almost complete radio silence on this issue is worrying)
14 Likes
I expect the main issue is the choice to bundle the security fixes with the changes to support Thunderbolt certification. Iâm sure itâs the latter (and not the security fixes) thatâs the source of the bugs causing the delay in a final release, since those changes are likely the bulk of the complexity in the update.
That choice does not leave me with a positive impression. The security fixes should have been released standalone, with the Thunderbolt certification changes held for the next release. Bundling everything together feels like a pretty rookie software development mistake to me, even considering that a BIOS/firmware update is a riskier kind of update than other kinds of software updates, which might lead someone to think that the better move would be fewer overall updates.
8 Likes
Meanwhile, another nearly four weeks have passed and there is no further feedback from Framework. The communication behavior is lousy.
Forgive me for being blunt, but this is starting to remind me of Duke Nukem Forever, it is getting ridiculous in my eyes.
Have all the builds created since December failed internal validation? Are there really no improvements that are large or stable enough to release a new build, even when it is labeled as beta, signaling that it is not mature?
After more than six months and two nebulous announcements of further internal test versions, I would like to have more concrete information about the schedule and contents: What is the expected timing for the next beta? And what problems will be addressed, e.g. will we perhaps see better fan-, throttling- and energy management that some people domplained about? And will support for the larger batteries be implemented? Will all CVEs discovered until now be closed?
Or will we just get a then hopefully working update sometime in the second half of 2023 but at the level of the known issues of fall 2022?
Itâs done when itâs done is completely acceptable for free software, and might be even here if it were just about Thunderbolt certification. But it is (also) about security problems, bug fixes and support of new hardware. So if you still donât have a working solution for the Thunderbolt part, someone at Framework should make the decision to activate a plan B and separate it from the rest of the update to release the important and hopefully working parts in a reasonable short time frame. Even if this means more work for you and that the promised full Thunderbolt support will have to be delayed further, I think it would give you a better reputation than what we see now.
Besides, I paid for the device. And I paid more than I would have paid at a larger manufacturer because I had actually hoped for better and longer support for all important aspects of my notebook.
8 Likes
If it doesnât match your expectations you are free to sell it and find something that does. This is a very small company, it is wholly unsurprising that things take time and communication is intermittent. I donât know if they have a PR person, much less a team. Theyâre still working on a resolution for the 11th gen board, so in my mind they are supporting their systems.
1 Like
Yup. IMO at this point we should be getting weekly updates at least. Even if the update is just âweâre continuing testing but weâre not satisfied the build is readyâ.
My suspicion is that work on this update has been put on hold due to other priorities, but theyâre certainly not going to tell us that.
2 Likes
Oh please, what a cop-out. Itâs perfectly reasonable to expect, demand, and push for a higher level of support from a company that has sold you a product.
Selling that product on the secondhand market and buying something new from another vendor should be considered a last resort.
10 Likes