70
Encryption-breaking, password-leaking bug in many AMD CPUs could take months to fix
(arstechnica.com)
this post was submitted on 26 Jul 2023
70 points (98.6% liked)
Privacy
31833 readers
183 users here now
A place to discuss privacy and freedom in the digital world.
Privacy has become a very important issue in modern society, with companies and governments constantly abusing their power, more and more people are waking up to the importance of digital privacy.
In this community everyone is welcome to post links and discuss topics related to privacy.
Some Rules
- Posting a link to a website containing tracking isn't great, if contents of the website are behind a paywall maybe copy them into the post
- Don't promote proprietary software
- Try to keep things on topic
- If you have a question, please try searching for previous discussions, maybe it has already been answered
- Reposts are fine, but should have at least a couple of weeks in between so that the post can reach a new audience
- Be nice :)
Related communities
Chat rooms
-
[Matrix/Element]Dead
much thanks to @gary_host_laptop for the logo design :)
founded 5 years ago
MODERATORS
you are viewing a single comment's thread
view the rest of the comments
view the rest of the comments
What are the rules on responsible disclosure? Shouldnt they have waited until patches are ready before public disclosure of the exploit?
I mean, this was disclosed to AMD a few months back and there actually is a patch available currently for Epyc CPUs.
It'd be nice if they waited until all the patches were out, but I'd rather this than a full zero-day exploit of this scale in the wild.
It's very weird it takes them so long to fix this for consumers tbh. You'd think they could just take the snippet from Epyc and patch it into AGESA, since it's exactly the same architecture. December is hardly acceptable for a critical vulnerability like this.
This is a great opportunity to remind people the NoScript, HTTPS-only modes and filter lists for malicious websites (to use in your adblock of choice) exist. Use them.
This kind of shit is exactly why I use uMatrix as well as uBlock Origin. It allows me to monitor and control 3rd party scripts and allow only what's needed for a website. If a malicious 3rd party script does happen to get injected into things; I usually notice...especially if it actually breaks shit on the website by not loading it.
Unless it was exposed to a zero day, in which they need to publicize the problem immediately and provide a timeline