A remote code execution vulnerability in AMD systems remains unpatched after the company declined to address it, raising questions about the chipmaker's vulnerability disclosure practices.
A researcher has publicly disclosed a remote code execution (RCE) vulnerability affecting AMD systems that the company refused to fix, according to details shared on security-focused forums.
The vulnerability, detailed in a technical writeup, demonstrates how an attacker could execute arbitrary code on affected AMD hardware. The researcher initially reported the flaw through AMD's security disclosure process, but the company declined to patch it.
AMD's refusal to remediate the vulnerability contrasts with standard industry practice, where chipmakers typically address critical security flaws affecting their processors. The company did not provide public explanation for declining the fix.
The disclosure has gained attention in security circles, with 147 points and 42 comments on Hacker News, indicating substantial community interest. The full technical details are available in the researcher's writeup, which includes proof-of-concept information.
This incident highlights ongoing tensions between security researchers and hardware manufacturers regarding vulnerability disclosure timelines and remediation obligations. While software companies often face pressure to patch vulnerabilities quickly, hardware flaws present different challenges due to longer update cycles and firmware dependency.
The disclosure raises broader questions about AMD's vulnerability management strategy and whether the company considers this particular RCE a low priority or beyond the scope of its support obligations.
Security researchers and system administrators using affected AMD hardware should review the technical details to determine their exposure and implement mitigations if available.
Security researchers have identified potential hardware backdoors in certain x86 processors. The findings, detailed in a GitHub repository called Rosenbridge, reveal vulnerabilities at the processor level that could allow unauthorized access.
Flock Safety, the traffic camera company, is expanding beyond law enforcement with plans to deploy dashcams in rideshare vehicles and offer coaching services to police departments.
A sharp rise in explicit deepfake images of UK children has been reported by an online safety service, as authorities warn that AI tools are making the creation of sexualized or 'nudified' content increasingly accessible.
Gen's latest threat report details two distinct attack campaigns exploiting compromised email accounts and clipboard manipulation to steal from businesses and cryptocurrency users.