Report Claims AMD Ryzen, EPYC CPUs Contain 13 Security Flaws

[cinergy]

Wow, Tom's just dropped this fake news without any background checks. This is obviously a scam, a not even very convincing one.

 

[Questors]

Smells like seafood that fell behind the back seat of the car during a week of 100+°.

 

[e3expert]

CTS reports are very suspicious, it would be just like an Intel lobby to engage an out of country entity to slander AMD, typical destructive behaviour set by the avaricious. Microsoft is probably implicated in this as well.

 

[madmatt30]

In fairness to people criticising toms , they're merely posting info that every other tech related website is.

News is news , thats all this post actually is.
They havent condoned or agreed with any of this crap, merely posted a link to public info .

 

[JamesSneed]

No real security researcher would give a chip maker 24 hours notice. The standard is 90 days notice or more for hardware flaws ie 6 months for Spectre/Meltdown.

Notices are nothing more than courtesy, there is no binding "standard" for any particular time window. We'll see soon enough whether AMD confirms or denies the claims.

True but the way they hyped this comes off wrong. If you as a security researcher really feel these are that important wouldn't you at least give the vendor time to at least formulate a response? Nothing they did feels like they did it to improve the security of AMD products instead this feels like a PR stunt or attack.

 

[InvalidError]

True but the way they hyped this comes off wrong. If you as a security researcher really feel these are that important wouldn't you at least give the vendor time to at least formulate a response?

Since the exploits require acquiring admin access to the machine first, there isn't all that much for AMD to respond to in the first place - the exploits merely allow AMD-based systems to get more pwned than usual once compromised, still need to compromise them through conventional means to begin with and at that point, you're already kind of screwed anyway.

Just like Spectre and Meltdown, as long as you can keep malicious software out of your system, the flaws themselves become irrelevant. If malicious software does get on your PC, then you have worse issues than those particular flaws to worry about.

 

[sfcampbell]

.

 

[sfcampbell]

You've got to be kidding me -- Brand new company? First discovery? 13 vulnerabilities? This is a deliberate malicious hack-job strategically planned to tank the Zen+ release!

TH, you're smart enough to figure this out!!!

 

[sfcampbell]

Sounds like a rumor if there has been no evidence or sources listed. And given the short 24 hour notice it makes the whole thing a bit shady. Possibly to manipulate stock prices? Hopefully it's all false, or the vulnerabilities are easy/quick to fix.

Lol @JoeNM84 your message made me think:
"Wow if CTS-Labs provided this study to AMD more than 24 hours in advance, and AMD was able to debunk the entire allegation, what else could make CTS-Labs famous?" :lol:

 

[sfcampbell]

From Anandtech:
"...we cannot confirm in the findings are accurate. It has been brought to our attention that some press were pre-briefed on the issue, perhaps before AMD was notified, and that the website that CTS-Labs has setup for the issue was registered on February 22nd, several weeks ago. Given the level of graphics on the site, it does look like a planned ‘announcement’ has been in the works for a little while, seemingly with little regard for AMD’s response on the issue.[...] CTS-Labs has also hired a PR firm to deal with incoming requests for information, which is also an interesting avenue to the story, as this is normally not the route these security companies take.[...] CTS-Labs was started in 2017, and this is their first public report."

And the award for insight, transparency, and integrity goes to... Anandtech!

 

[fykusfire]

https://fossbytes.com/linus-torvalds-roasts-cts-labs-amd-cpu-vulnerabilty-report/

 

[killsmack]

Well if everyone wants to play the Intel Conspiracy, I'll play devils advocate.
- Company X releases a competitive product and starts grabbing market share.
Company X realizes its value will raise.
- Someone (r) wants money (nothing devils advocate there).
- "Company" Y releases "hard hitting info" which drops Company X's value.
- "r" purchases stock at lower value.
- Company Y's "hard hitting info" is deemed "fake news".
- Stock prices rise.
- "r" makes money.
- Company Z, Company X's competitor takes Conspiracy blame.
- Company Y and "r" share the spoils.

.Break.

I was under the impression meltdown and specter effected Intel and AMD? Serious question, I keep reading it does, and I keep seeing people ignore one of them. If it does, I doubt there is any conspiracy there.
Down with the king!

.Break.

Here is another Devils Advocate for you, well at least the line of thought.
- There are a few countries attempting to make competitive CPUs
(Yes, they might not be on equal grounds now, but ask yourself this:
If I am a ambitious company wanting a global presence, do I wait
until I have the product that competes? Or do I prepare the battle
space ahead of time?)
- There are two incumbent CPU players. There loss is good for the rest.
- Breaking consumer faith in the two incumbents is good for the rest.
- Players with tunnel vision can't see whats around them, allowing unfettered
movement.

Anyways the point of all of this is, while you might dislike Intel and think them the devil outside the canyon (heh), without some evidence you merely become a pawn in a scheme. If there is one.

Or maybe you are right.

 

[InvalidError]

- There are two incumbent CPU players.

Only in the x86 space. In the ARM world, there are multiple companies with semi-custom and homebrew cores along with countless designs relying on straight ARM IP-cores instead of HDL or ISA-only licenses.

If ARM manages to break into the server and desktop/laptop space, x86 may get overrun pretty quickly. For now though, ARM is still mainly known for walled-garden ecosystems like phone, tablets, smart TVs, chromebooks, netbooks, etc.

If Microsoft is successful in promoting its portable applications environment, CPU ISAs may become largely irrelevant a few more years from now.

 

[tooterfishes]

sounds (reads) like a hit job to me. i say no deal to cts, and encourage AMD to respond with all that the law allows.

 

[littleleo]

Tom's continuing to bring up this issue makes me wonder if Tom's is connected in some way to CTS financially. CTS sound like bush league operation trying to sound professional, but the don't pull it off. The more Tom's keeps recirculating this the more they they fall into the mud with them.

 

[amaback007]

Amazing !! just when AMD is announcing their 2000 series the 2700, 2700x and more, here comes news with AMD getting one day's warning.

Does that Israeli company work for Intel? The timing and buffer for disclosure is 24 hours.