3 ms·

This was great on AMD's part. They responded to all of the issues and also put it into perspective. Also, it looks like they are in-line with releasing fixes (

This was great on AMD's part. They responded to all of the issues and also put it into perspective. Also, it looks like they are in-line with releasing fixes (in a couple of weeks) way under the 90 day disclosure timeframe.

jimmies 9y ago
It's also straightforward and to the point, and no dancing around.
ChrisSD 9y ago
I'm slightly wary about this "90 day disclosure timeframe". There's no way 90 days should be THE standard. Coordinated disclosure should be highly dependent on the situation. 90 days is far too long for most issues. I get why the industry likes that; a generous timeframe makes their bug fixing efforts look better. But I'm not sure that it's in anyone else's interests.
vatueil 9y ago
Glad AMD plans to patch the exploits, not that I ever expected they would't. And CTS Labs deserves all the blame they received. But I hope this also puts to rest the claims that the vulnerabilities weren't real or that Trail of Bits were paid to fake their results. AMD is confirming that the PSP exploits could circumvent security and make persistent changes. The fact that an attacker needs to acquire admin access first doesn't mean the exploits aren't serious. To reiterate, CTS Labs certainly over-hyped the impact, and it's understandable why people reacted as they did. But if this were an Intel ME bug (and such exploits have been found in the past), I doubt as many people would have leaped to criticize an independent auditor or downplay the vulnerability (more than it deserved, that is, since it was over-hyped initially).
- rphlx 9y ago
  I am frankly shocked at how many people wanted to nail CTS to a cross for the method of disclosure while granting something like an "it's cool bro" to AMD. These are truly serious flaws that, IMO, greatly undermine the "third party security audit" that AMD did in lieu of open-sourcing or publicly documenting the PSP last year. 1. Whichever third party security firm they hired should be discredited and ashamed. 2. AMD should work with its partners to provide a feature which verifiably and permanently halts the PSP CPU when the BIOS exits POST, for users who do not need the TPM feature. If they just minimally-patch these specific bugs, within a year some other security company will probably find more. Or worse, next time, malicious actors will find them instead. Most users should not trust, and should not permit, these secondary "liability cores" to continue to run alongside the x86_64 OS.

jimmies 9y ago

It's also straightforward and to the point, and no dancing around.

ChrisSD 9y ago

I'm slightly wary about this "90 day disclosure timeframe". There's no way 90 days should be THE standard. Coordinated disclosure should be highly dependent on the situation. 90 days is far too long for most issues. I get why the industry likes that; a generous timeframe makes their bug fixing efforts look better. But I'm not sure that it's in anyone else's interests.

vatueil 9y ago

Glad AMD plans to patch the exploits, not that I ever expected they would't. And CTS Labs deserves all the blame they received. But I hope this also puts to rest the claims that the vulnerabilities weren't real or that Trail of Bits were paid to fake their results. AMD is confirming that the PSP exploits could circumvent security and make persistent changes. The fact that an attacker needs to acquire admin access first doesn't mean the exploits aren't serious. To reiterate, CTS Labs certainly over-hyped the impact, and it's understandable why people reacted as they did. But if this were an Intel ME bug (and such exploits have been found in the past), I doubt as many people would have leaped to criticize an independent auditor or downplay the vulnerability (more than it deserved, that is, since it was over-hyped initially).

rphlx 9y ago
I am frankly shocked at how many people wanted to nail CTS to a cross for the method of disclosure while granting something like an "it's cool bro" to AMD. These are truly serious flaws that, IMO, greatly undermine the "third party security audit" that AMD did in lieu of open-sourcing or publicly documenting the PSP last year. 1. Whichever third party security firm they hired should be discredited and ashamed. 2. AMD should work with its partners to provide a feature which verifiably and permanently halts the PSP CPU when the BIOS exits POST, for users who do not need the TPM feature. If they just minimally-patch these specific bugs, within a year some other security company will probably find more. Or worse, next time, malicious actors will find them instead. Most users should not trust, and should not permit, these secondary "liability cores" to continue to run alongside the x86_64 OS.