AMD PSP Affected By Vulnerability

[phoronix]

Phoronix: AMD PSP Affected By Remote Code Execution Vulnerability

While all eyes have been on Intel this week with the Spectre and Meltdown vulnerabilities, a disclosure was publicly made this week surrounding AMD's PSP Secure Processor in an unrelated security bulletin...

http://www.phoronix.com/scan.php?page=news_item&px=AMD-PSP-2018-Vulnerability

[chuckula]

Something Something Something Intel's ME engine is NSA backdoor something something something... AMD LOVES PUPPIES!

Interesting difference between Intel's ME and AMD's PSP: Intel can at least control ME. PSP is pretty much licensed from third parties so AMD isn't even fully in control of its own black box.

[carewolf]

Go home 2018, you are drunk

[Guest]

Interesting difference between Intel's ME and AMD's PSP: Intel can at least control ME. PSP is pretty much licensed from third parties so AMD isn't even fully in control of its own black box.

Not true, motherboard vendors are given Intels reference ME implementation that they are free to fuck with as they please (or leave it stock). No idea about PSP, I would imagine it's the same. This is why when you use me_cleaner and flash modified image you sometimes get different warnings on screen depending on the board, why board vendors each implement TPM modules differently (TPM is part of ME) and why QST (fan controls, temp monitoring, ...) works across various boards. E.g. think of ME as a template/specification/reference implementation.

This is also why we still have to wait for BIOS updates on certain boards to get ME updates.

Q: Why do I need to contact my system or motherboard manufacturer? Why can’t Intel provide the necessary update for my system?
A: Intel is unable to provide a generic update due to management engine firmware customizations performed by system and motherboard manufacturers.

https://www.intel.com/content/www/us.../software.html

[oooverclocker]

Please AMD, let people disable this feature in the bios (if "possible"). I have a bios that professes to have an option ("BIOS PSP Support") to "disable" the PSP and I am using it although my CPU can't be overclocked anymore.
I am completely intolerant to security risks and I really hope that you will not make the same mistakes like Intel. But I'm afraid of it because this bios has been pulled off the internet again.
When neither the PSP nor the ME can be deactivated with proof in the near future there will be no alternative for other nations than building their own microprocessors that support either LibreBoot or have similar options. Zhaoxin will just be the first one, Russians and Europeans will follow - from a logical perspective, there is absolutely no doubt.

I appreciate the wonderful work hugely, especially what AMD has achieved for open source and Linux. And so do the customers. But in case of the PSP it's a serious warning! Please notice that the ME can be overwritten partially while the PSP can currently not be deactivated at all with an officially available bios. So for people who intend to flash the ME to death you do not have an advantage but a disadvantage in this case.
I do not have any intention to prefer Chinese cpus over cpus of the US but the first one supporting LibreBoot will be the one whose products I will buy when the performance is sufficient for what I use them.

[ssokolow]

Well, there goes more justification for my plans to make my next gaming PC an Intel.

If I need maximum single-thread performance for my emulators (meaning no used pre-PSP Opterons), at least me_cleaner exists for Intel offerings.

[davidbepo]

in the latest agesa there is an option to disable PSP so dont worry

[artivision]

in the latest agesa there is an option to disable PSP so dont worry

If someone knows, is there anything like ARM Trustzone (DRM obfuscation) inside Intel and AMD processors? Also AMD said years before that they will have enthusiast platform without all this stuff, there is no point deactivate them if some day half the web pressures you to reactivate it (in order to have access). Also is there anyone European who thinks that this is the time for legal action?

[starshipeleven]

Good, Google is fighting the good battle. The more bullshit they find, the more likely AMD or Intel get pressure from their customers (OEMs) to remove ME and PSP bullshit.

Interesting difference between Intel's ME and AMD's PSP: Intel can at least control ME. PSP is pretty much licensed from third parties so AMD isn't even fully in control of its own black box.

That's bullshit, AMD did LICENSE stuff. They control their own stuff. The license forbids them from open-sourcing it, but they won't do it anyway, for the same reasons Intel won't when they 100% can.

[cb88]

Intel actually licenses the processor it uses for the ME from another company as well... it has been several different processors ARC and Sparc and Intel Quark (only after ME 11).

ARM Trustzone that AMD licenses is actually good... as it is a product ARM sells entirely on the basis of it's security...