[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

Re: AMD crash bug

To: cve-editorial-board-list <cve-editorial-board-list@lists.mitre.org>
Subject: Re: AMD crash bug
From: "Adinolfi, Daniel R" <dadinolfi@mitre.org>
Date: Mon, 27 Mar 2017 14:55:29 +0000
Accept-language: en-US
Authentication-results: spf=none (sender IP is 129.83.29.2) smtp.mailfrom=LISTS.MITRE.ORG; mitre.mail.onmicrosoft.com; dkim=none (message not signed) header.d=none;mitre.mail.onmicrosoft.com; dmarc=none action=none header.from=mitre.org;
Delivery-date: Mon Mar 27 11:12:05 2017
In-reply-to: <CANO=Ty2S1js+1tGp_GLbg7nuvyUbV-gDXMeDK=KeQRish+VxXw@mail.gmail.com>
List-help: <mailto:LISTSERV@LISTS.MITRE.ORG?body=INFO%20CVE-EDITORIAL-BOARD-LIST>
List-owner: <mailto:CVE-EDITORIAL-BOARD-LIST-request@LISTS.MITRE.ORG>
List-subscribe: <mailto:CVE-EDITORIAL-BOARD-LIST-subscribe-request@LISTS.MITRE.ORG>
List-unsubscribe: <mailto:CVE-EDITORIAL-BOARD-LIST-unsubscribe-request@LISTS.MITRE.ORG>
References: <CABqVa39PVei4oJHGS0dW+qh6Ptoz3NUKu-TrLLitiJd-qT=Qtg@mail.gmail.com> <2A66C262-934D-45B4-8E79-B40308F6FBFE@intel.com> <1490317981.26769.21.camel@cerias.purdue.edu> <CANO=Ty2S1js+1tGp_GLbg7nuvyUbV-gDXMeDK=KeQRish+VxXw@mail.gmail.com>
Sender: <owner-cve-editorial-board-list@lists.mitre.org>
Spamdiagnosticmetadata: 6cdb8bfc89744bd8bfee511e3e65aa05
Spamdiagnosticoutput: 1:2
Thread-index: AQHSpDZmv4x3yRbCYE6h6O3QxlIBNKGjJvYAgAAILICAAUH8AIAEF8CA
Thread-topic: AMD crash bug
User-agent: Microsoft-MacOutlook/f.20.0.170309

Folks,

To follow up on this issue, it has been given a CVE ID: <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7262>

Please let us know if there are any questions.

Thanks.

-Dan

From: <owner-cve-editorial-board-list@lists.mitre.org> on behalf of Kurt Seifried <kseifried@redhat.com>
Date: Friday, March 24, 2017 at 16:25
To: Pascal Meunier <pmeunier@cerias.purdue.edu>
Cc: "Landfield, Kent B" <kent.b.landfield@intel.com>, Kurt Seifried <kurt@seifried.org>, cve-editorial-board-list <cve-editorial-board-list@lists.mitre.org>
Subject: Re: AMD crash bug

I'm not sure that the microcode is vulnerable per se, simply that they fixed it via a microcode update (which again blurs the line between hardware/software rather a lot if this is a "hardware" bug =). .

On Thu, Mar 23, 2017 at 7:13 PM, Pascal Meunier <pmeunier@cerias.purdue.edu> wrote:

IMO giving an ID to vulnerable microcode fits the goals of the CVE, both
originally and now. Lovely catch, Kurt.

Pascal

On Fri, 2017-03-24 at 00:43 +0000, Landfield, Kent B wrote:
> I agree. This seems to be in need of a CVE. Is AMD aware of it?
>
> Kent Landfield
> +1.817.637.8026
>
> On Mar 23, 2017, at 7:34 PM, Kurt Seifried <kurt@seifried.org<mailto:kurt@seifried.org>> wrote:
>
> So a Linux/Windows kernel crash triggered by a normal user would get a CVE. Why doesn't this get a CVE? Especially as it's fixable with a microcode update...
>
> http://forum.hwbot.org/showthread.php?t=167605
> http://forum.hwbot.org/showpost.php?p=480524
> https://news.ycombinator.com/item?id=13924192
>
> I think we need to cover hardware cases where it bricks/crashes the system/hardware at a minimum.
>
> Also I always thought AMD was a CNA, but they're not?
>
> --
> Kurt Seifried
> kurt@seifried.org<mailto:kurt@seifried.org>

Kurt Seifried -- Red Hat -- Product Security -- Cloud
PGP A90B F995 7350 148F 66BF 7554 160D 4553 5E26 7993
Red Hat Product Security contact: secalert@redhat.com

References:
- AMD crash bug
  - From: Kurt Seifried <kurt@seifried.org>
- Re: AMD crash bug
  - From: "Landfield, Kent B" <kent.b.landfield@intel.com>
- Re: AMD crash bug
  - From: Pascal Meunier <pmeunier@cerias.purdue.edu>
- Re: AMD crash bug
  - From: Kurt Seifried <kseifried@redhat.com>

Prev by Date: Re: Hidden Microsoft CVEs And No Answers
Next by Date: RE: Hidden Microsoft CVEs And No Answers
Previous by thread: Re: AMD crash bug
Next by thread: CVE Board Meeting Minutes - 8 March 2017
Index(es):
- Date
- Thread