The bug allows attackers to swipe data from a CPU’s registers. […] the exploit doesn’t require physical hardware access and can be triggered by loading JavaScript on a malicious website.

  • @[email protected]
    link
    fedilink
    121 year ago

    What are the rules on responsible disclosure? Shouldnt they have waited until patches are ready before public disclosure of the exploit?

    • @[email protected]
      link
      fedilink
      181 year ago

      I mean, this was disclosed to AMD a few months back and there actually is a patch available currently for Epyc CPUs.

      It’d be nice if they waited until all the patches were out, but I’d rather this than a full zero-day exploit of this scale in the wild.

      • UnfortunateShort
        link
        12
        edit-2
        1 year ago

        It’s very weird it takes them so long to fix this for consumers tbh. You’d think they could just take the snippet from Epyc and patch it into AGESA, since it’s exactly the same architecture. December is hardly acceptable for a critical vulnerability like this.

        This is a great opportunity to remind people that NoScript, HTTPS-only modes and filter lists for malicious websites (to use in your adblock of choice) exist. Use them.

        • Melody Fwygon
          link
          fedilink
          21 year ago

          This kind of shit is exactly why I use uMatrix as well as uBlock Origin. It allows me to monitor and control 3rd party scripts and allow only what’s needed for a website. If a malicious 3rd party script does happen to get injected into things; I usually notice…especially if it actually breaks shit on the website by not loading it.

    • The Quuuuuill
      link
      fedilink
      31 year ago

      Unless it was exposed to a zero day, in which they need to publicize the problem immediately and provide a timeline

  • @[email protected]
    link
    fedilink
    71 year ago

    I’m curious - does this kind of report make people less likely to go with an AMD cpu? The last time I was thinking about building a new pc, AMD had just definitively taken the lead in speed per dollar, and I would have gone with one of the higher end chips. I’m not sure whether this would have affected my decision, but I’d probably be concerned with performance degradation as well as the security issue. I’d have waited for the patch to buy a system with updated firmware, but Od still want to see what the impact was as well as learn more about the exploit and whether there were additional issues.

    I ended up just getting a steam deck and all of my other computers are macs, so it’s hard to put myself back into the builder’s/buyer’s headspace.

    • @[email protected]
      link
      fedilink
      181 year ago

      does this kind of report make people less likely to go with an AMD cpu?

      I doubt it, since Intel has its share of similar CPU security issues. For several generations the understanding has been that Intel’s CPUs arrive with impressive performance on day 1, then gradually leak that performance away as security issues are patched over subsequent months.

    • @[email protected]
      link
      fedilink
      111 year ago

      Honestly no. Remember Spectre & Meltdown vulnerabilities back in 2018? Yeah that security bug that only affected Intel CPUs until it was patched seriously told consumers and enterprise customers to “please turn off hyperthreading” to prevent exposure. Fucking LOL. Voluntarily cut my CPU performance in half!? Based on a theoretical exploit that was only found in a very specific and controlled environment before everyone started FREAKING out?

      • @[email protected]
        link
        fedilink
        51 year ago

        I’ve been out of the builder world for long enough that I didn’t follow the 2018 bug. I’m more from the F00F generation in any case. I also took a VLSI course somewhere in the mid-90s that convinced me to do anything other than design chips. I seem to remember something else from that era where a firmware based security bug related to something I want to say was browser-based, but it wasn’t the CPU iirc.

        In any case, I get the point you and others are making about evaluating the risks of a security flaw before taking steps that might hurt performance or worrying about it too much.

    • Dark Arc
      link
      7
      edit-2
      1 year ago

      I’m curious - does this kind of report make people less likely to go with an AMD cpu?

      For me, nah. This is well within the vein of “normal” problems for a CPU these days (neither AMD nor Intel seem to be able to avoid this sort of thing 100%)… and this particular issue seems to be fixed in hardware already for their Zen 3 chips (Nov 2020-Sept 2022) and Zen 4 chips (Sept 2022 - Present).