The bug allows attackers to swipe data from a CPU’s registers. […] the exploit doesn’t require physical hardware access and can be triggered by loading JavaScript on a malicious website.
What are the rules on responsible disclosure? Shouldnt they have waited until patches are ready before public disclosure of the exploit?
I mean, this was disclosed to AMD a few months back and there actually is a patch available currently for Epyc CPUs.
It’d be nice if they waited until all the patches were out, but I’d rather this than a full zero-day exploit of this scale in the wild.
It’s very weird it takes them so long to fix this for consumers tbh. You’d think they could just take the snippet from Epyc and patch it into AGESA, since it’s exactly the same architecture. December is hardly acceptable for a critical vulnerability like this.
This is a great opportunity to remind people that NoScript, HTTPS-only modes and filter lists for malicious websites (to use in your adblock of choice) exist. Use them.
This kind of shit is exactly why I use uMatrix as well as uBlock Origin. It allows me to monitor and control 3rd party scripts and allow only what’s needed for a website. If a malicious 3rd party script does happen to get injected into things; I usually notice…especially if it actually breaks shit on the website by not loading it.
Unless it was exposed to a zero day, in which they need to publicize the problem immediately and provide a timeline
I’m curious - does this kind of report make people less likely to go with an AMD cpu? The last time I was thinking about building a new pc, AMD had just definitively taken the lead in speed per dollar, and I would have gone with one of the higher end chips. I’m not sure whether this would have affected my decision, but I’d probably be concerned with performance degradation as well as the security issue. I’d have waited for the patch to buy a system with updated firmware, but Od still want to see what the impact was as well as learn more about the exploit and whether there were additional issues.
I ended up just getting a steam deck and all of my other computers are macs, so it’s hard to put myself back into the builder’s/buyer’s headspace.
does this kind of report make people less likely to go with an AMD cpu?
I doubt it, since Intel has its share of similar CPU security issues. For several generations the understanding has been that Intel’s CPUs arrive with impressive performance on day 1, then gradually leak that performance away as security issues are patched over subsequent months.
Thanks! That’s exactly the kind of insight I was hoping for.
Honestly no. Remember Spectre & Meltdown vulnerabilities back in 2018? Yeah that security bug that only affected Intel CPUs until it was patched seriously told consumers and enterprise customers to “please turn off hyperthreading” to prevent exposure. Fucking LOL. Voluntarily cut my CPU performance in half!? Based on a theoretical exploit that was only found in a very specific and controlled environment before everyone started FREAKING out?
I’ve been out of the builder world for long enough that I didn’t follow the 2018 bug. I’m more from the F00F generation in any case. I also took a VLSI course somewhere in the mid-90s that convinced me to do anything other than design chips. I seem to remember something else from that era where a firmware based security bug related to something I want to say was browser-based, but it wasn’t the CPU iirc.
In any case, I get the point you and others are making about evaluating the risks of a security flaw before taking steps that might hurt performance or worrying about it too much.
I’m curious - does this kind of report make people less likely to go with an AMD cpu?
For me, nah. This is well within the vein of “normal” problems for a CPU these days (neither AMD nor Intel seem to be able to avoid this sort of thing 100%)… and this particular issue seems to be fixed in hardware already for their Zen 3 chips (Nov 2020-Sept 2022) and Zen 4 chips (Sept 2022 - Present).
