WebLLL

Ok, but if a working web browser POC is not worthy of a bug bounty reward, because they claim to already know, then what is the point of the bug bounty? Why are they not just paying for specialists to advise them on how to fix this if they have no plan. They don't even listen when you try and try and try to explained what needs to be done. How can a bug bounty fix this?

Fact is they are still patching away! And yes I have seen no public disclosure on many of the problems. Try asking Intel for help, it is a brick wall. My guess is that they made a huge mistake, that they thought that high precision timers were needed, and they did not put the effort into otherwise fixing the problems. Lack of sharing probably made it much worse. They had still not addressed these at the public disclosure date. They either realized the mistake themselves or various people told them of their mistakes, and they were left with known vulnerable products on the market that they had no hope of fixing in a timely manner. At that point they could have advised their users to move to alternative products, e.g. Google had a head start, but that would likely have ended them, most people would not come back many months later when they claim to have fixed the problems, and that is a big expense for them! Another alternative was to take drastic coding measures, lfence branch paths, but at a high performance loss, they did not do that either, again who wants a slow product if the competition has not also taken the same action. The really kicker is people had been trying to get them to move on this for years and they had been resisting it strongly.

The offer is limit to bugs that are not already known to Microsoft or their partners, and they are not disclosing what these bugs are, and they are making no claim to have fixed them. I made a submission to Intel and others weeks after some were claiming to have mitigated this with small reductions in timer resolution, showing that the timer mitigation would not stop these vulnerabilities, no one would pay out, said they were already aware of it, have they informed the public, have they withdrawn their product, have their transitioned their user base to safer products??? No one is going to hand over their well documented exploits under such terms. Let them offer twice the reward for public disclosures of issues that they already know and have not fixed or not warned the public about, and then we might take their offer seriously.

Precise timers are not needed, but they improve the data rate. For an efficient technique to bypass timer mitigation and a proof of concept see https://weblll.org/index.php/spectre-cascade-there-may-be-no...