81–90 of 245 posts
Earlier quoted context omitted.
Bigger than KASLR it seems. https://twitter.com/brainsmoke/status/948561799875502080 Not good.
That's a tweet of someone using the bug to defeat KASLR.
Intel believes these exploits do not have the potential to corrupt, modify or delete data. Followed by... Check with your operating system vendor or system manufacturer and apply any available updates as soon as they are available. This press release is a minefield. There are whole paragraphs devoted to say nothing.
Interesting use of language: 'Recent reports that these exploits... are unique to Intel products are incorrect... Intel is committed to product and customer security and is working closely with many other technology companies, including AMD...' Someone new to the issue might think AMD also has this problem. Similarly (replacing the first elision in the above quote): 'Recent reports that these exploits are caused by a…
Not defending Intel here, but devils advocate... You will find many clients asking how to disable, for example, the Linux patch. Linux is releasing with a flag to disable it, so there is some merit. Why would you want that? There are a lot of times you trust everything running on your box and don't need to take the perf hit. Intel (and possibly other archs/families) found a perf win that ends up having security impli…
> Intel believes these exploits do not have the potential to corrupt, modify or delete data. Reading from kernel memory [edit: from unprivileged apps] is still a severe security issue though, right? This sounds like they're trying to downplay that hard, especially with the "operating as designed" phrase. > Recent reports that these exploits are caused by a “bug” or a “flaw” [Unprivileged] reading from kernel memory i…
Has to be pointed out that they were correct. Public outrage forced them to change their tune, but their original summary was still on point. That said, it of course could majorly impact a select few.
> Intel believes its products are the most secure in the world https://security-center.intel.com/advisory.aspx?intelid=INTE...
"The most secure in the world" does not mean "flawless". Thinking like that is pretty dangerous (and silly)
It comes across as fairly defensive. Presumably the statement was hastily put together, but it's not really the tone you want to strike when you have a lot of worried customers wondering what is going on. > Intel believes its products are the most secure in the world and that, with the support of its partners, the current solutions to this issue provide the best possible security for its customers. A rather bizarre s…
>Presumably the statement was hastily put together I don't think so. Given that both *nix and MS seems to have been working on this for at least a month already it can't have come as a surprise.
Earlier quoted context omitted.
I do agree that there are passages in this press release that are totally justified e.g. their calling attention to the fact that other processor vendors have probably been incorporating this flaw into their designs for a while. However, their seemingly innocent mentioning of AMD as being a vendor with which they are coordinating to resolve this issue appears to unfairly (and probably deliberately) implicate AMD in a…
> their calling attention to the fact that many other processor vendors have been incorporating this flaw into their designs for while. You have a source for this claim? Because besides for Intel's press release I can't find any evidence that other manurfacture's processors are vulnerable to this bug.
...which was linked-to from this article: https://arstechnica.com/gadgets/2018/01/whats-behind-the-int...
No, but they do have the potential for privilege escalation or credential exfiltration, which in turn do grant the potential to corrupt, modify and delete data.