Ok, so these "AMD flaws" are nowhere near anything like Meltdown or Spectre.

According to their "whitepaper", it lets you pwn your PSP and chipset if you already have root access on the main CPU. In the worst case, it's like the Intel ME BUP bug from december.
It's useful for researchers, coreboot porting, breaking DRM, etc. But it's no use for a remote (or even unprivileged local) attacker.

Their website makes it look way more dangerous than it is.

Then there's a lot of fishy stuff, like
- too much effort went into the website's design
- the website has lots of infographics and not-very-specific text, repeating the same things over and over again
- the whitepaper doesn't look like a whitepaper, and seems to be written with non-technical people in mind, especially the first few pages
- they have a huge legal disclaimer that says they may have financial interest in the value of AMD shares
- cts-labs.com exists for less than 1 year

Show thread

@Wolf480pl also they only gave AMD 24 hours notice. 'responsible' disclosure my ass.

@samis the only place I've seen this is cnet. And I don't know if that means 24h from yesterday to releasing the "whitepaper", or from today to releasing full details.

If the latter, then yeah, reasonable my ass, but also not really harmful unless you run random programs as root, or flash a BIOS from a sketchy russian site.

If the former, then it's not a disclosure from the security POV, only from PR POV, which makes it look even more awful.


@Wolf480pl re disclosure period: 'AMD is in the process of responding to the claims, but was only given 24 hours of notice rather than the typical 90 days for standard vulnerability disclosure. No official reason was given for the shortened time.'

@samis I guess they got that info from AMD, but I still don't trust it as much as if I saw this on AMD's official website, or even on amdflaws.com.

@Wolf480pl AMD's verbatim announcement doesn't make them sound much better though. 'just received' doesn't imply any reasonable period.

Sign in to participate in the conversation

The social network of the future: No ads, no corporate surveillance, ethical design, and decentralization! Own your data with Mastodon!