SoylentNews is people
SoylentNews
Submitted via IRC for TheMightyBuzzard
AMD has fixed, but not yet released BIOS/UEFI/firmware updates for the general public for a security flaw affecting the AMD Secure Processor.
[...] Cfir Cohen, a security researcher with the Google Cloud Security Team, says he discovered a vulnerability in the Trusted Platform Module (TPM) of the AMD Secure Processor. The TPM is a component to store critical system data such as passwords, certificates, and encryption keys, in a secure environment and outside of the more easily accessible AMD cores.
"Through manual static analysis, we've found a stack-based overflow in the function EkCheckCurrentCert," Cohen says. The researcher claims that an attacker could use specially-crafted EK certificates to get remote code execution rights on the AMD Secure Processor, allowing him to compromise its security.
Cohen said that some basic mitigation techniques such as "stack cookies, NX stack, ASLR" were not implemented in AMD's Secure Processor, making exploitation trivial.
takyon: This bug is unrelated to Meltdown and Spectre. And you might be interested in this:
Source: Security Flaw in AMD's Secure Chip-On-Chip Processor Disclosed Online
(Score: 4, Funny) by Runaway1956 on Sunday January 07 2018, @09:45PM
You, the sheeple, aren't man enough to operate a motor vehicle safely, so, the result is gubbermint is going to take away the opportunity for you to fuck things up. And, you, oh gullible fool, think that this is a Good Thing. Gubbermint can and will track your every move - along with every major corporation. And, you're perfectly happy with that. Bravery and manliness, you say? Why don't you try it for yourself. It's only a little bit late to make a New Year's resolution. Tell yourself that "This year, I'm going to act like a man!"
I expect that you'll last about a day and a half, before you return to the forage offered by the mainstream media.