Zen CPUs Might Be Hit By 4 New Flaws UPDATED

[SteelCrysis]

http://www.tomshardware.com/news/cts-lab...36660.html

CTS Labs' CTO, Ilia Luk-Zilberman, has now posted a letter on the AMDflaws site that says much of what he told us. It's a somewhat curious screed in which he expounds on his distaste for the 90-day response window and his views on why it's not helpful. Partly, he said that he thinks alerting everyone at once (that is, consumers, media, and companies) puts public pressure on the companies to fix the vulnerabilities (it certainly does), and that by doing so without disclosing the actual technical details, no one is actually at risk. But that creates obvious problems, such as causing widespread FUD, and it invites backlash upon the security researchers, all of which he alluded to in the letter. The salient passage reads in part:

This model has a huge problem; how can you convince the public you are telling the truth without the technical details. And we have been paying that price of disbelief in the past 24h. The solution we came up with is a third party validation, like the one we did with Dan from trailofbits. In retrospect, we would have done this with 5 third party validators to remove any doubts. A lesson for next time.

Altogether, it seems that AMD customers may be justified in worrying about these vulnerabilities. If CTS Labs' description of them is accurate, they are remotely exploitable flaws that could allow attackers to install persistent malware in the deepest recesses of a system. That puts consumers at risk, and it could also undermine businesses' secure networks simply because they rely on Ryzen or EPYC processors.

But that brings us back to the curious fact that AMD had little time to respond to these allegations. Even if you take CTS Labs' stated reasoning for ignoring the industry standard 90-day windows at face value, it doesn't seem to make much sense. Because CTS Labs won't release more detailed information about the vulnerabilities to the public--a wise choice, technically, if they are indeed actually easy to exploit--we won't have concrete confirmation of their existence until AMD has had a chance to examine the problem. If CTS Labs did provide all the research it has to AMD, that shouldn't take long. We expect to learn more about the issue over the coming days--and to witness its potential aftermath over the coming weeks, months, and years.