The Ryzen/TR have MAJOR flaws.

[BigJob]

Initial reports have indicated that the vulnerabilities were verified by a 3rd party researcher as real, but the way this was all dumped on the public was likely theater designed to embarrass AMD and/or manipulate stock prices. The risk is definitely being exaggerated.

what if they went a step ahead and made up a 3rd party researcher to add to credibility? seems plausible.

[BigJob]

https://www.anandtech.com/show/12536...-with-cts-labs

HAHAH
---

IC: Can you describe how you came up with the names for these exploits?

YLZ: It was our creativity and fervent imagination.

IC: Did you pre-brief the press before you spoke to AMD?

ILO: What do you mean by pre-brief the press?

IC: We noticed that when the information went live, some press were ready to go with relevant stories and must have had the information in advance.

ILO: Before our announcement you mean?

IC: Correct.

ILO: I would have to check the timing on that and get back to you, I do not know off the top of my head.

DK: I think the biggest question that I still have is that ultimately who originated this request for analysis – who was the customer that kicked this all off?

ILO: I definitely am not going to comment on our customers.

DK: What about the flavor of customer: is it a semiconductor company, is it someone in the industry, or is it someone outside the industry? I don’t expect you to disclose the name but the genre seems quite reasonable.

ILO: Guys I’m sorry we’re really going to need to jump off this call but feel free to follow up with any more questions.

[Korth]

https://amdflaws.com/ is a proxy site registered through godaddy.com ... lol, not professional not legit.

Purpose? To generate hits on CTS Labs website, lol. Maybe also to look savvy and important, maybe also to bash and hate on AMD.

[xeromist]

what if they went a step ahead and made up a 3rd party researcher to add to credibility? seems plausible.

Dan Guido founded Trail of Bits in 2012. So no he's not a sock puppet. Whatever you believe about the piss poor way CTS handled the disclosure, the vulnerabilities are real.

[BigJob]

Dan Guido founded Trail of Bits in 2012. So no he's not a sock puppet. Whatever you believe about the piss poor way CTS handled the disclosure, the vulnerabilities are real.

ahhhh damnnnn
this was one of the reasons i was avoiding an intel upgrade.
grrr

[xeromist]

ahhhh damnnnn
this was one of the reasons i was avoiding an intel upgrade.
grrr

You still might be on the right track. Since this disclosure was even more abrupt than the Intel vulnerabilities we haven't seen much solid info yet. It could be that most of this is solved through OS patches or a BIOS update and there is no performance hit. We'll just have to see.

[xeromist]

And AMD has announced fixes. Ars Technica has details:
https://arstechnica.com/gadgets/2018...rocessor-bugs/

[segfaulted]

Curious, AMD states there are BIOS updates from vendors to address these. I don't however see anything listed from ASUS?

The bugs btw are _nothing_ like Spetre or Meltdown. If anything they are more like INTEL's IME/SP exploits.

[paulmarc]

Most importantly: vulnerabilities are exploitable if you have physical access and execute expert commands, sometimes even needing to open the computer case...
If the "hacker" has this level of access, better to take the storage drives and be on his merry way... Or plug a USB and infect the system. So many other "major" threats out there, for this level of security...

As for the patches themselves, I haven't found anything yet to download/patch/install, although as mentioned, AMD did acknowledge and stated it will provide patches.