|09-06-2012, 09:20 AM||#1|
Join Date: May 19 2008
[Anandtech.com] US-CERT Takes AMD To Task On Driver Security
In a bit of an odd move, the US Computer Emergency Readiness Team (US-CERT) has posted a vulnerability report and a blog post taking AMD to task over their drivers and the impact on system security. As the United States’ de-facto internet security agency – a public-private organization under the control of the DHS – US-CERT is both a front-line organization for developing responses to cybersecurity threats and on a more typical day is responsible for organizing and publishing reports and notices about computer system vulnerabilities. So while it’s common for US-CERT to publish information regarding specific vulnerabilities, it’s much less common for them to get involved with general security weaknesses.
So what has drawn US-CERT’s attention? It turns out that AMD’s drivers don’t properly behave with/support a vulnerability mitigation feature called Address Space Layout Randomization (ASLR). ASLR serves to make it harder for software vulnerabilities to be exploited by randomizing certain program structures in memory, so that the addresses of these structures cannot reliably be predicted and attacked. Although not undefeatable, ASLR can reduce a number of different types of attacks from a system-owning exploit into a program crash that keeps the system secure. In other words ASLR can’t fix the underlying vulnerabilities in programs, but it can help mitigate the problem so that a proper fix can be instituted.
Because of the chaotic nature of ASLR not every program (particularly legacy programs) can work with it, and for that reason since its introduction in Windows Vista in 2006 ASLR has been a per-program feature that is only enabled with applications that are flagged as being compatible. However because most applications can handle it just fine, systems requiring higher security can use the Enhanced Mitigation Experience Toolkit (EMET) to enable ASLR across the system, which forcibly activates ASLR for all programs.
It’s this last bit that has caught the US-CERT’s attention. As it stands AMD’s video drivers are not ASLR compatible. Turning on ASLR will cause AMD’s drivers to crash, making always-on ASLR unusable on systems using AMD’s drivers.
From a practical perspective this isn’t an issue that affects more than a handful of users. Unlike DEP it’s not something that can be turned on from within Windows, so even technical users like ourselves almost never have ASLR in always-on mode. However for governments and other high value institutions this means they’re forced to choose between AMD hardware and ASLR, which is not something they want to be worrying about. Furthermore it’s been the long-standing goal of computer security organizations to get OSes and programs to a state where ASLR can be enabled globally for every user, a very messy transition that is held back by programs and drivers that are still not ASLR compatible.
Drivers in turn are of particular concern here because of how they interact with the Windows kernel, with video drivers in particular having high access levels for performance purposes, a position that will only become more entrenched as GPUs continue to become more CPU-like and more important to even fundamental computing. All of this is compounded by the fact that AMD in has already been in the spotlight for security vulnerabilities as their drivers were found to have a security exploit in 2007.
Ultimately the US-CERT is looking to apply pressure to AMD to get them to finally make their drivers ASLR compatible, even going so far as to specifically testing and naming Intel and NVIDIA as having ASLR compatible drivers in the vulnerability note. Having an arm of the US Government breathing down your neck does tend to get results, doubleplus so since the US Government is also a massive IT buyer. In the meantime typical computer users have nothing to be concerned about – and this is the important part for most of us – but it’s unfortunate that AMD has let themselves end up in this situation in the first place.
|amd, anandtechcom, driver, security, takes, task, uscert|
|Currently Active Users Viewing This Thread: 1 (0 members and 1 guests)|
|Similar Threads for: [Anandtech.com] US-CERT Takes AMD To Task On Driver Security|
|Thread||Thread Starter||Forum||Replies||Last Post|
|[Anandtech.com] AMD Discontinues Monthly Driver Updates, Releases Catalyst 12.6 Beta||News||Reviews & News Online||0||02-06-2012 07:45 AM|
|[Anandtech.com] AMD Radeon HD 2000, HD 3000, & HD 4000 Video Cards Being Moved To Legacy Status In May||News||Reviews & News Online||0||24-04-2012 02:41 PM|
|[Anandtech.com] AMD Q1â??12 Earnings Report: $1.59B Revenue, $590M Net Loss||News||Reviews & News Online||0||21-04-2012 01:10 AM|
|[Anandtech.com] AMD Q4â??11 & FY 2011 Earnings Report: 1.69B Revenue For Q4, 6.57B Revenue For 2011||News||Reviews & News Online||0||26-01-2012 09:13 AM|
|[Anandtech.com] AMD Releases Catalyst 12.1 Preview â?? Custom Application Profiles, HD3D CrossFire, & More||News||Reviews & News Online||0||14-12-2011 05:00 AM|
All times are GMT +11. The time now is 08:13 AM.