5 ms·

So, is AMD effected or not? This seems fairly important. The Google blog post sort of goes against itself in this regard. AMD itself has said: "The threat and

So, is AMD effected or not? This seems fairly important. The Google blog post sort of goes against itself in this regard. AMD itself has said: "The threat and the response to the three variants differ by microprocessor company, and AMD is not susceptible to all three variants. Due to differences in AMD's architecture, we believe there is a near zero risk to AMD processors at this time." So either AMD is lying or Google's blog post is wrong. Granted AMD's statement is a bit muddled, not sure if they mean they aren't susceptible to all THREE variants (as in only 1/3) or they aren't susceptible to ALL three variants (as in none of them.)

caf 9y ago
AMD is saying that: !(susceptible_v1 && susceptible_v2 && susceptible_v3) They are not saying that: !susceptible_v1 && !susceptible_v2 && !susceptible_v3 (the latter would be rendered in English as: "AMD is not susceptible to any of the the three variants")
- Havoc 9y ago
  You've successfully made it less clear. There is a nice table on AMD's website though: https://www.amd.com/en/corporate/speculative-execution https://www.amd.com/en/corporate/speculative-execution
AsyncAwait 9y ago
It seems like it is not affected by the most serious bug, but may be by a lesser one.
- olliej 9y ago
  it is effected by spectre, but not by the other.
- partiallypro 9y ago
  That's what I'm thinking, effected by Spectre, but not by Meltdown. But more clarity would be appreciated on Google and AMD's front. I mean from a pure PR angle, AMD has a lot to gain if they can clear the air more.
guardiangod 9y ago
From the Spectre paper- We have empirically verified the vulnerability of several Intel processors to Spectre attacks, including Ivy Bridge, aswell and Skylake based processors. We have also verified the attack’s applicability to AMD Ryzen CPUs. Finally, we have also successfully mounted Spectre attacks on several Samsung and Qualcomm processors (which use an ARM architecture) found in popular mobile phones. So in other word, the researcher haven't tried it on AMD processors, but they think the attack would work. AMD, on the other hand, is saying the attack won't work. Frankly, I believe in PoC||GTFO, so AMD is safe in my book for now.
- civilitty 9y ago
  Spectre and Meltdown are two different exploits. In this case, the paper is talking about Spectre and they did have a POC that worked on all three major processor families (except for deterministic execution engines in microcontrollers and low end CPUs from ARM as well as a few early Atoms from Intel). AMD is saying that Meltdown, which at first glance seems like the most serious one, doesn't effect their processors.
  - guardiangod 9y ago
    I read the Spectre paper front to back. Where did the paper mention that they have a working PoC for AMD x86 CPUs?
- mike_hearn 9y ago
  That seems like a rather fragile interpretation of the statement. I had interpreted it to mean they tried the attack on Ryzen and it worked. Given the general nature of their technique why would it not work on AMD chips?
zAy0LfpBZLC8mAC 9y ago
As almost everyone seems to be getting this wrong: It's "affected", not "effected". "effected" means roughly "caused", while "affected" means roughly "influenced".

caf 9y ago

AMD is saying that: !(susceptible_v1 && susceptible_v2 && susceptible_v3) They are not saying that: !susceptible_v1 && !susceptible_v2 && !susceptible_v3 (the latter would be rendered in English as: "AMD is not susceptible to any of the the three variants")

Havoc 9y ago
You've successfully made it less clear. There is a nice table on AMD's website though: https://www.amd.com/en/corporate/speculative-execution https://www.amd.com/en/corporate/speculative-execution

AsyncAwait 9y ago

It seems like it is not affected by the most serious bug, but may be by a lesser one.

olliej 9y ago
it is effected by spectre, but not by the other.
partiallypro 9y ago
That's what I'm thinking, effected by Spectre, but not by Meltdown. But more clarity would be appreciated on Google and AMD's front. I mean from a pure PR angle, AMD has a lot to gain if they can clear the air more.

guardiangod 9y ago

From the Spectre paper- We have empirically verified the vulnerability of several Intel processors to Spectre attacks, including Ivy Bridge, aswell and Skylake based processors. We have also verified the attack’s applicability to AMD Ryzen CPUs. Finally, we have also successfully mounted Spectre attacks on several Samsung and Qualcomm processors (which use an ARM architecture) found in popular mobile phones. So in other word, the researcher haven't tried it on AMD processors, but they think the attack would work. AMD, on the other hand, is saying the attack won't work. Frankly, I believe in PoC||GTFO, so AMD is safe in my book for now.

civilitty 9y ago
Spectre and Meltdown are two different exploits. In this case, the paper is talking about Spectre and they did have a POC that worked on all three major processor families (except for deterministic execution engines in microcontrollers and low end CPUs from ARM as well as a few early Atoms from Intel). AMD is saying that Meltdown, which at first glance seems like the most serious one, doesn't effect their processors.
- guardiangod 9y ago
  I read the Spectre paper front to back. Where did the paper mention that they have a working PoC for AMD x86 CPUs?
mike_hearn 9y ago
That seems like a rather fragile interpretation of the statement. I had interpreted it to mean they tried the attack on Ryzen and it worked. Given the general nature of their technique why would it not work on AMD chips?

zAy0LfpBZLC8mAC 9y ago

As almost everyone seems to be getting this wrong: It's "affected", not "effected". "effected" means roughly "caused", while "affected" means roughly "influenced".