Gentoo Forums
Gentoo Forums
Gentoo Forums
Quick Search: in
AMD's PSP (their ME) has a flaw :)
View unanswered posts
View posts from last 24 hours

 
Reply to topic    Gentoo Forums Forum Index Off the Wall
View previous topic :: View next topic  
Author Message
Naib
Watchman
Watchman


Joined: 21 May 2004
Posts: 5494
Location: Removed by Neddy

PostPosted: Fri Jan 05, 2018 9:18 pm    Post subject: AMD's PSP (their ME) has a flaw :) Reply with quote

http://seclists.org/fulldisclosure/2018/Jan/12

Quote:
Through manual static analysis, we’ve found a stack-based overflow in the
function EkCheckCurrentCert.
This function is called from TPM2_CreatePrimary with user controlled data -
a DER encoded [6] endorsement key (EK) certificate stored in the NV
storage.

A TLV (type-length-value) structure is parsed and copied on to the parent
stack frame. Unfortunately, there are missing bounds checks, and a
specially crafted certificate can lead to a stack overflow:

_________________
The best argument against democracy is a five-minute conversation with the average voter
Great Britain is a republic, with a hereditary president, while the United States is a monarchy with an elective king
Back to top
View user's profile Send private message
pjp
Administrator
Administrator


Joined: 16 Apr 2002
Posts: 17508

PostPosted: Fri Jan 05, 2018 9:40 pm    Post subject: Reply with quote

As you mentioned below, at least they allowed (?) it to be disabled. Seems better than Intel.

Naib wrote:
Well apparently AMD are now exposing the PSP to the end user so they can disable (whether it really is disabled is another thing)

https://www.reddit.com/r/linuxmasterrace/comments/7i6kl7/amd_listened_to_us_and_added_a_psp_disable_option/?st=jawq1tt4&sh=eacf3aa8

_________________
It is what it is out there. So whatever it is, it is.
Back to top
View user's profile Send private message
Naib
Watchman
Watchman


Joined: 21 May 2004
Posts: 5494
Location: Removed by Neddy

PostPosted: Fri Jan 05, 2018 9:54 pm    Post subject: Reply with quote

Yup, it is suppose to be in agesa 1.0.0.7 but MSI are stuck at 1.0.0.6.
1.0.0.7 is very buggy and only Asus released it & now 1.1.0.0 is in testing. When MSI finally get around to releasing it I'll disable PSP
_________________
The best argument against democracy is a five-minute conversation with the average voter
Great Britain is a republic, with a hereditary president, while the United States is a monarchy with an elective king
Back to top
View user's profile Send private message
wswartzendruber
Veteran
Veteran


Joined: 23 Mar 2004
Posts: 1246
Location: Idaho, USA

PostPosted: Sat Jan 06, 2018 12:03 am    Post subject: Reply with quote

I look around and swear I'm the only sane one left. Then again, most engineers probably like having a job.

Management: "Hey, we want you to embed an IP-aware server inside our processors."
My response: "That's the stupidest idea I've heard in the past two years; you're an idiot."
_________________
Gun: Glock 19 Gen 4
Sights: XS DXT Big Dot
Holster: StealthGear VentCore IWB
Ammunition: Federal Premium HST 124gr
Light: Inforce APLc
Back to top
View user's profile Send private message
pjp
Administrator
Administrator


Joined: 16 Apr 2002
Posts: 17508

PostPosted: Sat Jan 06, 2018 12:28 am    Post subject: Reply with quote

Is that why you had to go back to CA?
_________________
It is what it is out there. So whatever it is, it is.
Back to top
View user's profile Send private message
wswartzendruber
Veteran
Veteran


Joined: 23 Mar 2004
Posts: 1246
Location: Idaho, USA

PostPosted: Sat Jan 06, 2018 1:03 am    Post subject: Reply with quote

pjp wrote:
Is that why you had to go back to CA?

You know, I still don't know why they really pulled me back for those three weeks. I just showed up and worked as normal.
_________________
Gun: Glock 19 Gen 4
Sights: XS DXT Big Dot
Holster: StealthGear VentCore IWB
Ammunition: Federal Premium HST 124gr
Light: Inforce APLc
Back to top
View user's profile Send private message
pjp
Administrator
Administrator


Joined: 16 Apr 2002
Posts: 17508

PostPosted: Sat Jan 06, 2018 1:12 am    Post subject: Reply with quote

Strange. That would've been my first question. "What did you bring me here to do, or what do you want me to accomplish while I'm here?"
_________________
It is what it is out there. So whatever it is, it is.
Back to top
View user's profile Send private message
patrix_neo
Guru
Guru


Joined: 08 Jan 2004
Posts: 474
Location: The Maldives

PostPosted: Sat Jan 06, 2018 3:31 am    Post subject: Reply with quote

Big brother...
Back to top
View user's profile Send private message
Muso
l33t
l33t


Joined: 22 Oct 2002
Posts: 810
Location: The Holy city of Honolulu

PostPosted: Sat Jan 06, 2018 3:36 am    Post subject: Reply with quote

pjp wrote:
Strange. That would've been my first question. "What did you bring me here to do, or what do you want me to accomplish while I'm here?"


They needed him there in person to implant a chip in his body.
_________________
Chemtrails don't actually exist.
The optical illusion of seeing white streaks crisscrossing a blue background in the presence of sunlight is a common hallucination that comes from drinking fluoridated water.
Back to top
View user's profile Send private message
pjp
Administrator
Administrator


Joined: 16 Apr 2002
Posts: 17508

PostPosted: Sat Jan 06, 2018 5:25 am    Post subject: Reply with quote

:lol:

My experience has been much more mundane: "Keeping morale in check."
_________________
It is what it is out there. So whatever it is, it is.
Back to top
View user's profile Send private message
Muso
l33t
l33t


Joined: 22 Oct 2002
Posts: 810
Location: The Holy city of Honolulu

PostPosted: Sat Jan 06, 2018 6:21 am    Post subject: Reply with quote

pjp wrote:
:lol:

My experience has been much more mundane: "Keeping morale in check."


Agreed.
_________________
Chemtrails don't actually exist.
The optical illusion of seeing white streaks crisscrossing a blue background in the presence of sunlight is a common hallucination that comes from drinking fluoridated water.
Back to top
View user's profile Send private message
wswartzendruber
Veteran
Veteran


Joined: 23 Mar 2004
Posts: 1246
Location: Idaho, USA

PostPosted: Sat Jan 06, 2018 6:45 am    Post subject: Reply with quote

Their official explanation was, "we just wanted to get some face time with you."
_________________
Gun: Glock 19 Gen 4
Sights: XS DXT Big Dot
Holster: StealthGear VentCore IWB
Ammunition: Federal Premium HST 124gr
Light: Inforce APLc
Back to top
View user's profile Send private message
Muso
l33t
l33t


Joined: 22 Oct 2002
Posts: 810
Location: The Holy city of Honolulu

PostPosted: Sat Jan 06, 2018 7:11 am    Post subject: Reply with quote

wswartzendruber wrote:
Their official explanation was, "we just wanted to get some face time with you."


So, #pjpWasRight
_________________
Chemtrails don't actually exist.
The optical illusion of seeing white streaks crisscrossing a blue background in the presence of sunlight is a common hallucination that comes from drinking fluoridated water.
Back to top
View user's profile Send private message
pjp
Administrator
Administrator


Joined: 16 Apr 2002
Posts: 17508

PostPosted: Sat Jan 06, 2018 1:03 pm    Post subject: Reply with quote

Muso wrote:
wswartzendruber wrote:
Their official explanation was, "we just wanted to get some face time with you."


So, #pjpWasRight
:lol:

Actually, if it is stated "up front," I don't mind that much. I thought it was impressive that they let him move to and work from another state. So without any other information, they at least sound more decent than most.
_________________
It is what it is out there. So whatever it is, it is.
Back to top
View user's profile Send private message
Naib
Watchman
Watchman


Joined: 21 May 2004
Posts: 5494
Location: Removed by Neddy

PostPosted: Thu Feb 08, 2018 10:29 pm    Post subject: Reply with quote

pjp wrote:
As you mentioned below, at least they allowed (?) it to be disabled. Seems better than Intel.

Naib wrote:
Well apparently AMD are now exposing the PSP to the end user so they can disable (whether it really is disabled is another thing)

https://www.reddit.com/r/linuxmasterrace/comments/7i6kl7/amd_listened_to_us_and_added_a_psp_disable_option/?st=jawq1tt4&sh=eacf3aa8
just coming back to this as my mobo manufacture bumped the bios code and it has AGESA 1.1.0.1 & sure enough there is a BIOS option to disable trusted computing and PSP... disabled.

Now whether it actually disables is a different thing :) it could be a shiny UI that does nothing.
_________________
The best argument against democracy is a five-minute conversation with the average voter
Great Britain is a republic, with a hereditary president, while the United States is a monarchy with an elective king
Back to top
View user's profile Send private message
zixnub
n00b
n00b


Joined: 27 Dec 2007
Posts: 67
Location: Brasschaat, Belgium

PostPosted: Thu Feb 08, 2018 11:18 pm    Post subject: Reply with quote

wswartzendruber wrote:
I look around and swear I'm the only sane one left. Then again, most engineers probably like having a job.

Management: "Hey, we want you to embed an IP-aware server inside our processors."
My response: "That's the stupidest idea I've heard in the past two years; you're an idiot."


"Your communication is rather direct and blunt mr Zixnub"
-Did I ever tell a lie or insulted anyone?
"...well.. no..."
-Good
_________________
https://github.com/udevbe/greenfield
https://github.com/udevbe/westfield
Back to top
View user's profile Send private message
pjp
Administrator
Administrator


Joined: 16 Apr 2002
Posts: 17508

PostPosted: Fri Feb 09, 2018 3:15 am    Post subject: Reply with quote

Naib wrote:
just coming back to this as my mobo manufacture bumped the bios code and it has AGESA 1.1.0.1 & sure enough there is a BIOS option to disable trusted computing and PSP... disabled.

Now whether it actually disables is a different thing :) it could be a shiny UI that does nothing.
Unless they've been made an offer they couldn't refuse, I'd guess it works. Of course, the new backdoor may work just fine.
_________________
It is what it is out there. So whatever it is, it is.
Back to top
View user's profile Send private message
Display posts from previous:   
Reply to topic    Gentoo Forums Forum Index Off the Wall All times are GMT
Page 1 of 1

 
Jump to:  
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum