4 ms·

Lots of replies saying 'unable to reproduce' for various different Ryzens, so I don't think this is all it's made out to be.

danarmak 5y ago
He also says, > But even better, it has a security descriptor allowing Everyone + Low IL R/W Access, and an IOCTL interface with absolutely no Probes/SEH, which yes, dereferences wild pointers. They don't even bother checking for input size or output sizes. If that's true of the driver, then it's a sec vuln regardless of what the MSR bit does or doesn't do, no?
- Perolan 5y ago
  That's a quote / follow up from the previous Twitter thread about how their driver does fucked things. Absolutely a security vulnerability, and while I havent reproduced on my own and am just going off what I read on the original Twitter thread (so it's possible I could be regurgitating bad info), my understanding is that it gives processes this access by listening to process creation and hashing the name. Meaning if I have a known hash from the list I can simply rename my program / malware and bam.
danarmak 5y ago
He posted again later clarifying which systems and configuration were vulnerable: https://twitter.com/aionescu/status/1393955460517040129 https://twitter.com/aionescu/status/1393955460517040129 > * AMD Zen "Summit Ridge" Stepping B1. That is Ryzen's 1xxx series. > * AMD Zen2 "Matisse", "XT" series only. That is Ryzen's 3xxx series. Other info at: https://twitter.com/aionescu/status/1394039410300051456 https://twitter.com/aionescu/status/1394039410300051456 https://twitter.com/aionescu/status/1394359314102427650 https://twitter.com/aionescu/status/1394359314102427650 https://twitter.com/aionescu/status/1394359317038452738 https://twitter.com/aionescu/status/1394359317038452738 Regardless, the vulnerability is in the driver, not the CPU / microcode. Also in the WHQL process that signed such a 'fake' driver. Until the signature is revoked, it might be possible for an attacker to manually install the signed driver on other system configurations too.
vince14 5y ago
Because they can't read and are missing a module.
zeeZ 5y ago
From the screenshots they post it looks like they're missing a powershell module that's not built-in. I tried to install the NtObjectManager module, but Bitdefender blocked it as Gen:Variant.Ursu.903319

danarmak 5y ago

He also says, > But even better, it has a security descriptor allowing Everyone + Low IL R/W Access, and an IOCTL interface with absolutely no Probes/SEH, which yes, dereferences wild pointers. They don't even bother checking for input size or output sizes. If that's true of the driver, then it's a sec vuln regardless of what the MSR bit does or doesn't do, no?

Perolan 5y ago
That's a quote / follow up from the previous Twitter thread about how their driver does fucked things. Absolutely a security vulnerability, and while I havent reproduced on my own and am just going off what I read on the original Twitter thread (so it's possible I could be regurgitating bad info), my understanding is that it gives processes this access by listening to process creation and hashing the name. Meaning if I have a known hash from the list I can simply rename my program / malware and bam.

danarmak 5y ago

He posted again later clarifying which systems and configuration were vulnerable: https://twitter.com/aionescu/status/1393955460517040129 https://twitter.com/aionescu/status/1393955460517040129 > * AMD Zen "Summit Ridge" Stepping B1. That is Ryzen's 1xxx series. > * AMD Zen2 "Matisse", "XT" series only. That is Ryzen's 3xxx series. Other info at: https://twitter.com/aionescu/status/1394039410300051456 https://twitter.com/aionescu/status/1394039410300051456 https://twitter.com/aionescu/status/1394359314102427650 https://twitter.com/aionescu/status/1394359314102427650 https://twitter.com/aionescu/status/1394359317038452738 https://twitter.com/aionescu/status/1394359317038452738 Regardless, the vulnerability is in the driver, not the CPU / microcode. Also in the WHQL process that signed such a 'fake' driver. Until the signature is revoked, it might be possible for an attacker to manually install the signed driver on other system configurations too.

vince14 5y ago

Because they can't read and are missing a module.

zeeZ 5y ago

From the screenshots they post it looks like they're missing a powershell module that's not built-in. I tried to install the NtObjectManager module, but Bitdefender blocked it as Gen:Variant.Ursu.903319