Support NeoGAF

[Leonidas]

AMD CPUs for the past 9 years are vulnerable to data leak attacks

It's not just Intel chips that are vulnerable to hard-to-fix security flaws. Researchers at the Graz University of Technology have detailed a pair of side channel attacks under the "Take A Way" name that can leak data from AMD processors dating back to 2011, whether it's an old Athlon 64 X2, a...

www.engadget.com

Damn, that includes every single Ryzen CPU released to date.

Unlike some side channel attacks, it hasn't taken long to show how these exploits would work in the real world. The team took advantage of the flaws using JavaScript in common browsers like Chrome and Firefox, not to mention virtual machines in the cloud...

It's possible to address the flaw through a mix of hardware and software, the researchers said, although it's not certain how much this would affect performance. Software and firmware fixes for Meltdown and Spectre have typically involved speed penalties, although the exact hit depends on the task.

We've asked AMD for comment. However, the authors suggest that AMD has been slow to respond. They said they submitted the flaws to AMD in late August 2019, but haven't heard back despite keeping quiet about the flaw for the past several months.

Update #3 3/9/2020 7:20am PT:

AMD responded to our queries with an advisory the company posted to its website. This advisory does not point to any mitigations for the attack in question, merely citing other mitigated speculative executions that were used as a vehicle to attack the L1D cache predictor. AMD's posting also lists general advice for protecting against the incredibly large family of side channel attacks, but there aren't any specific mention of firmware patches for the Take A Way vulnerabilities.

AMD responded for our request for more information and says there are no new mitigations required, as this issue is covered by the existing side channel attack mitigations.

The researchers do not agree, stating that this vulnerability is still active. Until the two sides agree it isn't possible to ascertain which viewpoint is more accurate. We'll update as necessary and keep an eye out for a CVE.

Original Source: Tom's Hardware

 

[Nasemann]

Nooooo.

 

[ethomaz]

So same issues Intel faced sometime ago.

A single JavaScript surfing the internet can expose your data?

It will be interesting to see how the CPUs will work after fixes.

 

[MadchesterManc]

Ya know the Toms Hardware article on the subject has actually been updated with an AMD response...

 

[ethomaz]

Ya know the Toms Hardware article on the subject has actually been updated with an AMD response...

Their response is basically a non-response...

 

[MadchesterManc]

Their response is basically a non-response...

But the source in the OP claims no response at all. Guessing this the wrong type of thread to post updated info

 

[llien]

Damn, that includes every single Ryzen CPU released to date.

#DamageControl

In times when this isn't even thread worthy, #yawn

Researchers Find Unfixable Vulnerability Inside Intel CPUs

Researchers have found another vulnerability Inside Intel's Converged Security and Management Engine (CSME). For starters, the CSME is a tiny CPU within a CPU that has access to whole data throughput and is dedicated to the security of the whole SoC. The CSME system is a kind of a black box...

www.techpowerup.com

And, wait for it.... the dramatic twist:

...Hardware Unboxed found disclosures that Intel funded the research, raising concerns about the objectivity of the study

and, for more drama.... TADAAA:

AMD responded for our request for more information and says there are no new mitigations required, as this issue is covered by the existing side channel attack mitigations.

`

 

[Shin]

All you need to know (he's the professor of the researchers):

 

[Iorv3th]

Didn't the intel problem require something to be installed locally?

It's pretty nuts if this can occur by just visiting a webpage running java script.

 

[Kenpachii]

Like i said before, if you think your CPU is not vulnerable u are just kidding yourself every CPU is wide open to attacks and will always be.

These things are only interesting for company's not for us.

 

[Jigsaah]

*opens up Robinhood...types in AMD....mashes the sell button.

 

[SantaC]

5 years of Intel CPUs and chipsets have a concerning flaw that’s unfixable

Converged Security and Management Engine flaw may jeopardize Intel's root of trust.

arstechnica.com

 

[10000]

well AMD already addressed this issue, it is already mitigated, it is not slow response tho

also I won't buy intel at all because they had ton of flaws discovered every month compared to amd ones

 

[Panajev2001a]

AMD CPUs for the past 9 years are vulnerable to data leak attacks

It's not just Intel chips that are vulnerable to hard-to-fix security flaws. Researchers at the Graz University of Technology have detailed a pair of side channel attacks under the "Take A Way" name that can leak data from AMD processors dating back to 2011, whether it's an old Athlon 64 X2, a...

www.engadget.com

Damn, that includes every single Ryzen CPU released to date.





Original Source: Tom's Hardware

A Leonidas thread trying to hype up bad AMD news ... shocking ...

Edit: Rational analysis from a reputable source (Marcan):

 

[Elektro Demon]

I knew you were gonna make this thread. You seem to really love shitting on AMD.
This is actually nothing when compared to Intel's security flaws.

 

[ethomaz]

well AMD already addressed this issue, it is already mitigated, it is not slow response tho

also I won't buy intel at all because they had ton of flaws discovered every month compared to amd ones

Actually they just release a default PR reply.

The issues is not mitigate like the researcher confirmed.

 

[Ascend]

Intel's way of trying to take AMD down with them regarding the security flaws. No one with a brain falls for it. Especially if they know Intel's history and their 'business' practices.

 

[GymWolf]

same as intel

 

[michaelius]

So same issues Intel faced sometime ago.

A single JavaScript surfing the internet can expose your data?

It will be interesting to see how the CPUs will work after fixes.

From what I'm reading elsewhere you need admin rights in the first place to execute code that uses the exploit and if you have them who cares you can get everything anyway.

 

[ethomaz]

same as intel

Intel issues was a bit more serious like with this AMD issue hackers can get you credit card number while with Intel they can get all credit card in your machine.

 

[Max_Po]

lol

 

[Insane Metal]

#DamageControl

In times when this isn't even thread worthy, #yawn

Researchers Find Unfixable Vulnerability Inside Intel CPUs

Researchers have found another vulnerability Inside Intel's Converged Security and Management Engine (CSME). For starters, the CSME is a tiny CPU within a CPU that has access to whole data throughput and is dedicated to the security of the whole SoC. The CSME system is a kind of a black box...

www.techpowerup.com

And, wait for it.... the dramatic twist:



and, for more drama.... TADAAA:

`

Hey Leonidas I wonder why you didn't post this one!

 

[CyberPanda]

I knew you were gonna make this thread. You seem to really love shitting on AMD.
This is actually nothing when compared to Intel's security flaws.

Lisa Su is the queen of tub girl.

 

[Elektro Demon]

Lisa Su is the queen of tub girl.

I had to google that. And now I wish I haven't done that.

 

[CyberPanda]

I had to google that. And now I wish I haven't done that.

Lmao

 

[PhoenixTank]

Haven't dived in enough to see the real impact here, but seems to require a spectre variant (v3 on AMD isn't it?) to exploit anyway? Sad times for computing with both x86 vendors.

 

[Panajev2001a]

Hey Leonidas I wonder why you didn't post this one!

I do not remember Leonidas ever posting non positive news about Intel, do you?

 

[ipukespiders]

So same issues Intel faced sometime ago.

What happened with that? I remember talk of a windows patch, and that it would cause performance issues. I haven't noticed anything (4690k).

 

[Silver Wattle]

AMD is vastly more secure than Intel's offerings, and even Intel exploits are exaggerated.

A whole lot of nothing, wow, much impressed.

 

[ethomaz]

What happened with that? I remember talk of a windows patch, and that it would cause performance issues. I haven't noticed anything (4690k).

They fixed the two biggest issues but at the cost of performance.

It is a combination of BIOS update (for microcode) and OS patch.

 

[PhoenixTank]

They fixed the two biggest issues but at the cost of performance.

Right. If we're talking "Meltdown" though I believe it is mostly unnoticeable unless you are performing a lot of syscalls (context switching?). So databases and things like that. The strangest thing was a performance dip on the HEDT 10 series Intel CPUs vs the equivalent 9 series HEDT chips. They had hardware fixes that the 9 series lacked and believe there is still some inconclusive finger pointing in that vague direction.
The haunting continues.

 

[Spukc]

HAHAHAHAHAHAHAHAHAHAHAHAHAHA

 

[marquimvfs]

Well, AMD answer was pretty evasive for my taste...

 

[Elektro Demon]

https://wccftech.com/intel-csme-irreparable-boot-flaw-yet-another-intel-security-vulnerability/

Intel CSME Irreparable Boot Flaw – Yet Another Intel Security Vulnerability

This is bad news for Intel users across the board as the only method of securing their systems is to upgrade to 10th Generation Intel CPUs and motherboards as those products are immune to the CSME flaw, go back nearly ten years to a legacy Intel platform before CSME's integration, or switch to AMD.

At least those vulnerabilities AMD has are fixable, unlike Intel's recently found vulnerabilities.

 

[Flick]

Thats bad.

 

[GreatnessRD]

I do not remember Leonidas ever posting non positive news about Intel, do you?

None of these weirdos do when it comes to their allegiance to billion dollar corporations.

 

[Rolling_Start]

If Intel had spent the last decade more concerned about multiple, massive critical security vulnerabilities engineered into the very heart of their own high margin architectures...

... perhaps they'd now be spending less time and money finding ways to hype up far less critical, far less severe, and far less frequently occurring flaws in their rival's (now far more performant and cost effective) platform architectures.

If you are nightly shitting the bed, don't try to draw attention to someone who your paid investigators saw spill some coffee.

 

[ethomaz]

https://wccftech.com/intel-csme-irreparable-boot-flaw-yet-another-intel-security-vulnerability/

Intel CSME Irreparable Boot Flaw – Yet Another Intel Security Vulnerability



At least those vulnerabilities AMD has are fixable, unlike Intel's recently found vulnerabilities.

What’s is the fix? The bug made birthday and nothing from AMD.

 

[Elektro Demon]

What’s is the fix? The bug made birthday and nothing from AMD.

I think I read somewhere that it's fixable via microcode update.
If I find the article, I'll link it.

 

[ethomaz]

I think I read somewhere that it's fixable via microcode update.
If I find the article, I'll link it.

Yeap but AMD did not fix it yet.
After the AMD default reply the research said that...

 

[Elektro Demon]

Yeap but AMD did not fit it.
After the AMD default reply the research said that...

But it's not something that isn't fixable by an update.
Intel's case is different, they have a hardware problem, IE not fixable by software updates.

 

[ethomaz]

I forget to like what the researcher guess AMD can do.



He share this article as the best he could find describing the bug.

AMD processors from 2011 to 2019 vulnerable to two new attacks

Academics disclose new Collide+Probe and Load+Reload attacks on AMD CPUs.

www.zdnet.com

 

[thicc_girls_are_teh_best]

x86 was a mistake.

 

[M3Freak]

I'm still going AMD for my next build.

 

[PhoenixTank]

Are we at the point that we need a big thread just for CPU exploits now? Haunting continues.
Links posted in order of increasing detail:

Meltdown The Sequel strikes Intel chips – and full mitigation against data-meddling LVI flaw will slash performance

Chipzilla's silicon will surrender secrets if properly probed

www.theregister.co.uk

LVI: Hijacking Transient Execution with Load Value Injection

lviattack.eu

Software Security Guidance from Intel

Find software developer resources, guidance, and insights for security advisories.

software.intel.com

 

[Rolling_Start]

I think we should accept that there are serious issues with all x86 architectures.

But that the worst come in a relentless wave from Intel.

And also that Intel are spending real money trying to fling any mud they can at AMD.

And that paid shit flinging is actually quite effective with certain partisan degenerates.

Don't trust those folks.