sirdarckcat
Joined 14 years ago
Karma
149
Submissions
35
Member since
Jan 10
Recent submissions
Comment · 1 year ago
It's just written by the CPU during a ucode update
Comment · 1 year ago
> This probably depends on a lot of non-public info: how does the PSP validate CPU state?
https://github.com/amd/AMD-ASPFW/blob/3ca6650dd35d878b3fcbe5...
Comment · 1 year ago
> But raw write access to the flash depends on you being in SMM
Look at tests/stop.sh and check the different segments (ls:, ms:, etc you can also address them like 0:[..], 1, 2, 3,... 15:[...]). One of those is probably flash. If you know how that looks like try to dump it first with a load and then check which segment and which address it is at and then write back to it.
Comment · 1 year ago
You can make a new instruction (or repurpose an existing one) that accesses physical memory bypassing the page walk, which would be faster. You can also make instructions that bypasses some checks (like privilege checks) and squeeze some tiny performance. Note this would introduce security issues though, so you could only use it on trusted software.
Comment · 1 year ago
We were not able to demonstrate that Zen5 is affected. If we end up doing so, we may release a new advisory or something.
Comment · 2 years ago
151515 is such an elitist number..
3 * 13 * 37 * 3 * 5 * 7
Comment · 3 years ago
[citation needed]
* ChromeOS, COS and Android are opensource, and they are all up to date. Mind elaborating?
Comment · 4 years ago
> Sometimes I wish there was a Linux kernel security advisory process, but this would need funding or a dedicated volunteer.
This is already happening https://osv.dev/list?q=Kernel&affected_only=true&page=1&ecos...
Comment · 4 years ago
for what is worth, the link gregkh pointed you to explains the answer for your first 2 points.
Your last point is wrong. Simple example, which of the following thousand bugs are exploitable? https://syzkaller.appspot.com/upstream
If you can exploit them, you can earn 20,000 to 90,000 USD on https://google.github.io/kctf/vrp
Comment · 5 years ago
about duplicates - google has this thing called grants https://bughunters.google.com/about/rules/5479188746993664 that pay people for doing security research, even if they don't find any bugs. we agree that doing security research is valuable even if no bugs are fixed.
about having access to private bugs, we don't want to share vulnerabilities with others without the researcher's permission, but the original researcher can make bugs public on the new website, you can see some of them here https://bughunters.google.com/report/reports
Comment · 5 years ago
It can be tiring at times.
Comment · 5 years ago
Insecurity is invisible. Users have no way to know the weaknesses in the software they use until it's too late. Disclosure is meant to make it possible for users to see what weaknesses they might have so they can make informed decisions.
Users still benefit to know about issues that can't be fixed (think about Rowhammer, Spectre and similar), so as these attacks become more practical (eg https://leaky.page or half double) they can adjust their choices accordingly (switching browsers, devices, etc) if the risk imposed by them is too high.
Of course (using an analogy for a second), some can say that it would be better for people to never find out that they are at increased risk of some incurable disease, because they can't do anything about it.
But for software, you can't make individual decisions like that. Even if one person doesn't want to know about vulnerabilities in the software they use, others could still actually benefit to know about them, and the benefit of the many trump over the preferences of the few.
That is, unless the argument is that it's actively damaging for all of the public (or the majority) to know about vulnerabilities in the software they use. If the point is to advocate for complete unlimited secrecy, and for researchers to sit on unfixed bugs forever, then that's quite an extreme view of software security and vulnerability disclosure (but that some companies unfortunately still follow).
Disclosure policies like these aim to strike a balance between secrecy and public awareness. They put the onus of disclosure on the finder because it's their finding (and they are the deciders on how it's shared), and finders are more independent than the vendor, but I could imagine a world in which disclosure happens by default, by the company, even for unfixed bugs.
Comment · 5 years ago
Vulnerability deadlines are disclosure deadlines, not remediation deadlines. There's plenty of vulnerabilities that can't be fixed in that time, and I think it's fair for the public to know about them rather than keeping them secret forever.