US-CERT discloses security flaw in Intel chips

[HalloweenJack]

http://www.csoonline.com/article/708...in-intel-chips

June 15, 2012— CSO— The U.S. Computer Emergency Readiness Team (US-CERT) has disclosed a flaw in Intel chips that could allow hackers to gain control of Windows and other operating systems, security experts say.

The flaw was disclosed the vulnerability in a security advisory released this week. Hackers could exploit the flaw to execute malicious code with kernel privileges, said a report in the Bitdefender blog.

best not use Intel CPU`s with AMD video cards - you`ll have the marines kicking down your door !!

[kalniel]

What have AMD video cards go to do with anything?

But as usual, this was already patched so it only affects people who aren't updating windows:

http://technet.microsoft.com/en-us/s...letin/MS12-042

The vulnerabilities could allow elevation of privilege if an attacker logs on to an affected system and runs a specially crafted application that exploits the vulnerability. An attacker must have valid logon credentials and be able to log on locally to exploit this vulnerability. The vulnerability could not be exploited remotely or by anonymous users.

[scaryjim]

I know it's linked from the original article, but I don't see how that MS bulletin can relate to the same vulnerability. The MS bulletin addresses a vulnerability in Windows that can be triggered on both 32bit and 64bit (x64 *and* IA64) versions, whereas the Intel issue discussed in the CSO article *only* affects 64bit operations, *only* affects Intel EM64T CPUs (not Itanium ones), and can be triggered from free/netBDS as well as Windows. So, mega-link-fail, CSO!

[kalniel]

Maybe it's just the case that that fix also addresses the issue US-CERT are talking about, in Windows at least.

[HalloweenJack]

What have AMD video cards go to do with anything?

But as usual, this was already patched so it only affects people who aren't updating windows:

http://technet.microsoft.com/en-us/s...letin/MS12-042

http://www.kb.cert.org/vuls/id/458153

AMD drivers have a security hole as well

[kalniel]

Interesting, presumably the protection isn't enabled by default on nVidia drivers either given the requirement to enable it in registry.