Does AMD have Spectre and Meltdown-like security flaws???

[]-[itman]

3rd party verification is needed indeed... but, I'd be willing to bet these are all/mostly all real, just blown out of proportion.

EDIT: https://safefirmware.com/CTO+Letter.pdf

I don't think that letter changes the situation at all, at least IMO.

I do think that technically the attack vectors are real, but as you said, blown completely out of proportion and also their attack on the firmware of the PSP was already known with a fix incoming. They tweaked it slightly but it's basically the same thing (as far as we can tell without any real technical details) and the fix should still apply in their case.

 

[EarthDog]

I don't think it changes anything, but its another valuable piece of information.

I heard the CVE's for these will be out soon. Apparently in their past work they never published the issues they found so they never went through the process(?). Anandtech had a call with them today and should be publishing something soon. I will post it here.

 

[Johan45]

TPU has some dditional info up today

[CTS Labs] would like to address the many technical points and misunderstandings with a few technical clarifications about the vulnerabilities. The vulnerabilities described in our site are second-stage vulnerabilities. What this means is that the vulnerabilities are mostly relevant for enterprise networks, organizations and cloud providers.

Computers on enterprise networks occasionally get compromised - whether through phishing attempts, zero-day exploits or employees downloading the wrong file. High-security enterprise networks are equipped to deal with these kinds of "every-day" attacks. They do this by keeping their systems up to date, enabling security features, and employing additional measures such as endpoint security solutions.

The vulnerabilities described in amdflaws.com could give an attacker that has already gained initial foothold into one or more computers in the enterprise a significant advantage against IT and security teams.

The only thing the attacker would need after the initial local compromise is local admin privileges and an affected machine. To clarify misunderstandings - there is no need for physical access, no digital signatures, no additional vulnerability to reflash an unsigned BIOS. Buy a computer from the store, run the exploits as admin - and they will work (on the affected models as described on the site).

MORE: https://www.techpowerup.com/forums/...ifications-on-amd-zen-vulnerabilities.242391/

 

[]-[itman]

From extremetech, CTS Labs Responds to Allegations of Bad Faith Over AMD CPU Security Disclosures, Digs Itself a Deeper Hole:

If CTS Labs has accurately characterized these flaws, the problems in Asmedia controllers affect millions of Intel motherboards worldwide going back six years. In the early days of USB 3.0, before Intel added its own native chipset support, Asmedia was one of the most common third-party providers. Chips like the ASM1142 are still used on Intel motherboards today. When we looked at Newegg, nearly every USB 3.0 PCI Express card we spot-checked used an Asmedia solution — typically the ASM1042 or ASM1142.

If these Asmedia flaws are common to Intel, AMD, and standalone cards, Intel users and expansion card users absolutely should’ve been notified. If they’re unique to AMD users, CTS Labs needed to explain why. It has not. Again, when security researchers describe flaws, they typically describe them across the entire set of hardware on which they are known to occur. Failing that, they at least acknowledge the use of these broken solutions in other contexts. CTS Labs did neither.

https://www.extremetech.com/computi...ith-amd-security-disclosures-digs-deeper-hole

 

[]-[itman]

Ian Cutress of Anandtech doing a web interview about this:

It's a long watch but there are some good details in there about the story and his call with CTS. Lots of questions he posed with no real answer, deflections, obvious lack of understanding of the modern server/compute environment, lack of understanding of modern security protocol, certain elements of their story changing, outright lying (according to other industry contacts) about not being able to share technical details with anandtech due to Israeli law, etc.

Ian is careful about not drawing complete conclusions which he shouldn't given his position and lack of expertise in all these areas, but luckily we don't have that standard in a casual tech forum and can call a spade a spade. IMO.

 

[EarthDog]

I was waiting for him to put that up.

GUys... these are real. CVEs will come out. The concern is with the way it was handled.

 

[Alaric]

I wonder if Intel financed it. LOL

 

[rescuetoaster]

I wonder if Intel financed it. LOL

I just don't see Intel doing anything unethical or illegal - it would just be so unlike them.

 

[EarthDog]

Intel didnt have anything to do with it. While i understand everyone likes to hate on the big bad wo...intel, i dont think they would have let it come out IN THIS MANNER. They way this info was delivered to the public is abhorrent and intel wouldnt dare want to be a part of it IN THAT MANNER.

 

[]-[itman]

Anandtech's call with CTS is now in readable form though the video is still better to watch for a fuller story of the call. You can skip to the bottom where Ian gives commentary if you don't want to read the whole thing.

https://www.anandtech.com/show/1253...cts-labs?utm_source=twitter&utm_medium=social

Also, David Kanter and Linus weigh in a little on it:

Guys, CTS Labs is _obviously_ a scam

https://www.realworldtech.com/forum/?threadid=175139&curpostid=175169

Again, not saying that the vulnerabilities don't exist, but for sure they're also not what CTS is claiming them to be either.

 

[Alaric]

It was a joke, guys. Somewhat telling that the response to said joke is more qualifiers as to how Team Blue would have orchestrated it in a much more professional manner, though. LOL

 

[petteyg359]

I was waiting for him to put that up.

GUys... these are real. CVEs will come out. The concern is with the way it was handled.

No they aren't. Oh noes, somebody who already has my root password and physical access to my system can do things to it!oneoneeleven!1! Especially in the context of the report (blaming AMD), they're bull****, and it's no wonder people are pointing fingers at Intel and accusing them of stock manipulation and attempting to redirect attention to cover their own *** after their own flaws were publicized.

 

[Alaric]

While I have absolutely no evidence or rational belief-at present that Intel had ANYthing to do with this current scandal, I believe it is, as petteyg359 said, bullhockey of the highest odor-err, order. The crux of the matter seems to be that I can compromise my own system if I have an AMD chip? Cripes, I'm pretty sure that goes for Cyrix, ARM, Intel and Qualcomm and IBM's quantum rigs, too. This is beyond a non event. It's not even a good magic trick. It doesn't even rise to the level of unfounded rumor, from the depths of "Duh!".

 

[EarthDog]

No they aren't. Oh noes, somebody who already has my root password and physical access to my system can do things to it!oneoneeleven!1! Especially in the context of the report (blaming AMD), they're bull****, and it's no wonder people are pointing fingers at Intel and accusing them of stock manipulation trying to cover their own *** after their own flaws were publicized.

Maybe they will be rejected, but they were submitted.

IC: The standard procedure for vulnerability disclosure is to have a CVE filing and a Mitre numbers. We have seen in the public disclosures, even 0-day and 1-day public disclosures, have relevant CVE IDs. Can you describe why you haven’t in this case?

ILO: We have submitted everything we have to US Cert and we are still waiting to hear back from them.

 

[]-[itman]

AMD has released a statement. Anandtech has a summary.

https://www.anandtech.com/show/12556/amd-confirms-exploits-patched-in-weeks

The salient high-level takeaway from AMD is this:

All the issues can be confirmed on related AMD hardware, but require Admin Access at the metal
All the issues are set to be fixed within weeks, not months, through firmware patches and BIOS updates
No performance impact expected
None of these issues are Zen-specific, but relate to the PSP and ASMedia chipsets.
These are not related to the GPZ exploits [meltdown and spectre] earlier this year.

 

[Bluefalcon13]

AMD has released a statement. Anandtech has a summary.

https://www.anandtech.com/show/12556/amd-confirms-exploits-patched-in-weeks

BOOM! HEADSHOT![emoji23]

 

[EarthDog]

Well, they were real... just blown out of proportion.

 

[Bluefalcon13]

Well, they were real... just blown out of proportion.

I figured. Read the stuff and the same things stuck out to me. Came here to post the link but someone beat me to it [emoji50]

 

[Kenrou]

The "no performance impact is expected" is quite interesting.

 

[mackerel]

"No performance impact" isn't a big surprise, the vulnerabilities described don't relate directly to Ryzen core itself, but the associated security/management devices. Glad to see it is (mostly) blown over now, and we can play a game of waiting for a bios update for this at some point in future. Random thought if slightly off-topic, was there any talk of bios update for AMD platforms for Spectre?