News Intel Says it Doubled Down on Fixing Security Bugs in 2019

[Admin]

Intel released a report claiming it found almost two-thirds of related security bugs discovered in 2019, with most of the remaining found through its bug bounty program.

Intel Says it Doubled Down on Fixing Security Bugs in 2019 : Read more

 

[digitalgriffin]

Now the question is:
Why can't intel release a tool which generically disables AMT and performs CPU microcode updates?
Why does it have to be the motherboard vendors responsibility to update the CPU microcode?

Is it that hard for Intel to create a boot loader which updates CPU microcode? Or invalidates the UEFI area for AMT?

 

[margrave]

Yes, one more security hole please!

 

[bit_user]

Intel said that 91% of the reported bugs in 2019 were due to its investment in product assurance.

It's quite some PR spin for Intel to take credit for all of the bugs reported through their Bug Bounty program. I expect a majority of those were from researchers who would've disclosed the bugs, anyhow, but are quite willing to take any payment on offer.

Much respect to those who declined payment (although some might've been government agencies or big customers, who wouldn't be allowed to take what are effectively vendor kickbacks).

It also noted that none of the 236 vulnerabilities uncovered in 2019 were known to be used in attacks at the time of public disclosure.

Probably because these exploits are more difficult to find & utilize, leaving them as targets for governments & their contractors, who are more secretive and selective about their targets.

 

[bit_user]

Why can't intel release a tool which ... performs CPU microcode updates?

Why does it have to be the motherboard vendors responsibility to update the CPU microcode?

My guess is that Intel wants to allow platform vendors to qualify the microcode updates against their solution. The last thing Intel wants is to break some set of end users and be in the legal hot seat with the platform vendor. And, the way Intel's supplier agreements are probably worded, it's the latter who's ultimately liable to their customers for Intel's vulnerabilities. So, they're the ones who will have to get the patches into customers' hands.

In practical terms, Intel could do what you said, and it would be fine in the vast majority of cases. However, it doesn't take a lot of corner cases to create a very expensive legal headache.