News for hackers. Stuff that matters.

A comment on Google researchers discover 'Reptar', a new CPU vulnerability. Parent comment

Re:Google researchers discover 'Reptar', a new CPU vulnerabi... by ethbr1 on Tuesday November 14, 2023 @08:21PM (#38272208)
>> Getting to a vulnerability would require understanding exactly how the corrupted microcode state works, and that seems extremely difficult outside of Intel.

Intel knows exactly how their ROB works.

Therefore Intel knows the possible consequences of this bug and how to trigger them.

If there is a privilege execution path from this, Intel knows. And anyone Intel chose to share it with knew.

Thankfully, since it's public now, the value of that decreases and customers can begin to mitigate.

[ Parent | on HN ]
Re:Google researchers discover 'Reptar', a new CPU vulnerabi... by ajross on Tuesday November 14, 2023 @08:53PM (#38272416)
> If there is a privilege execution path from this, Intel knows. And anyone Intel chose to share it with knew.

No, or at least not yet. I mean, I've written plenty of bugs. More than I can count. How many of them were genuine security vulnerabilities if properly exploited? Probably not zero. But... I don't know. And I wrote the code!

[ Parent | on HN ]
Re:Google researchers discover 'Reptar', a new CPU vulnerabi... by saagarjha on Tuesday November 14, 2023 @11:23PM (#38273334)
Intel said it can be used for escalation if that answers your question.
[ Parent | on HN ]
Re:Google researchers discover 'Reptar', a new CPU vulnerabi... by lmm on Wednesday November 15, 2023 @12:28AM (#38273637)
Did they confirm that it can definitely be used for escalation? The description I saw was "may allow an authenticated user to potentially enable escalation of privilege and/or information disclosure and/or denial of service via local access" which sounds like they're covering all their bases and may not actually know what is and isn't possible.
[ Parent | on HN ]