Multiple OS Vendors Release Security Patches After Misinterpreting Intel Docs
bleepingcomputer.com
Multiple OS Vendors Release Security Patches After Misinterpreting Intel Docs
1–10 of 94 posts
Re: Multiple OS Vendors Release Security Patches After Misinterpreting Intel Docs
#2I'm sure the initial reaction here is going to be lamentation about the state of documentation. People will correctly point out that, if multiple entities misread the documentation, it just have been unclear. And they are right. But that doesn't make this Intel's fault alone. Clear or unclear, the documentation described behavior that was understood at the Intel organization, and the shipped product worked as described.
Where was the security testing at the OS level? Why can't there be automated test suites that catch unauthorized access issues before ship (if not before merge commit)? If your vendor delivers an insecure product and you don't discover it, how much blame do you share?
Re: Multiple OS Vendors Release Security Patches After Misinterpreting Intel Docs
#3Wow, the article shows that many vendors mis-read the docs: Apple, Microsoft, FreeBSD, Red Hat, Ubuntu, SUSE Linux, and other Linux distros...as well as VMware and Xen.
This is going to be a busy day!
Re: Multiple OS Vendors Release Security Patches After Misinterpreting Intel Docs
#4Is there a PoC exploit source?
Re: Multiple OS Vendors Release Security Patches After Misinterpreting Intel Docs
#5I'm sure the initial reaction here is going to be lamentation about the state of documentation. People will correctly point out that, if multiple entities misread the documentation, it just have been unclear. And they are right. But that doesn't make this Intel's fault alone. Clear or unclear, the documentation described behavior that was understood at the Intel organization, and the shipped product worked as describ…
Why can't there be automated test suites that catch unauthorized access issues before ship (if not before merge commit)?
Usually the search space is too large.
Re: Multiple OS Vendors Release Security Patches After Misinterpreting Intel Docs
#6Wow, the article shows that many vendors mis-read the docs: Apple, Microsoft, FreeBSD, Red Hat, Ubuntu, SUSE Linux, and other Linux distros...as well as VMware and Xen. This is going to be a busy day!
Maybe the docs were written badly? If everyone makes the same mistake, then there might be something wrong in the source.
Re: Multiple OS Vendors Release Security Patches After Misinterpreting Intel Docs
#7Wow, the article shows that many vendors mis-read the docs: Apple, Microsoft, FreeBSD, Red Hat, Ubuntu, SUSE Linux, and other Linux distros...as well as VMware and Xen. This is going to be a busy day!
At that point can it really be attributed to "mis-reading" the docs? If every single independent implementor understood it the same way, the docs were wrong.
Re: Multiple OS Vendors Release Security Patches After Misinterpreting Intel Docs
#8Interesting that some of the BSDs (Dragonfly, FreeBSD) are listed as Affected and others (NetBSD and OpenBSD) are listed as Not Affected.
Re: Multiple OS Vendors Release Security Patches After Misinterpreting Intel Docs
#9I'm sure the initial reaction here is going to be lamentation about the state of documentation. People will correctly point out that, if multiple entities misread the documentation, it just have been unclear. And they are right. But that doesn't make this Intel's fault alone. Clear or unclear, the documentation described behavior that was understood at the Intel organization, and the shipped product worked as describ…
Your idea is akin to searching the space of unknown unknowns, By definition someone can not even begin to quantify the space of what you don't know you don't know.
Re: Multiple OS Vendors Release Security Patches After Misinterpreting Intel Docs
#10It's been so long I had to look it up: SS is the stack segment.