3 ms·
I am frankly shocked at how many people wanted to nail CTS to a cross for the method of disclosure while granting something like an "it's cool bro" to AMD. Thes
by rphlx 9y ago
I am frankly shocked at how many people wanted to nail CTS to a cross for the method of disclosure while granting something like an "it's cool bro" to AMD. These are truly serious flaws that, IMO, greatly undermine the "third party security audit" that AMD did in lieu of open-sourcing or publicly documenting the PSP last year.
1. Whichever third party security firm they hired should be discredited and ashamed.
2. AMD should work with its partners to provide a feature which verifiably and permanently halts the PSP CPU when the BIOS exits POST, for users who do not need the TPM feature.
If they just minimally-patch these specific bugs, within a year some other security company will probably find more. Or worse, next time, malicious actors will find them instead.
Most users should not trust, and should not permit, these secondary "liability cores" to continue to run alongside the x86_64 OS.