News TikTag unfixable Arm vulnerability

[DJones]

Tiktag unfixable arm vulnerability.

Research paper

https://arxiv.org/pdf/2406.08719

 

[Viktor Jaep]

Tiktag unfixable arm vulnerability.

Research paper

https://arxiv.org/pdf/2406.08719

We are all so hosed!

 

[sfx2000]

Tiktag unfixable arm vulnerability.

No - just disable the feature for ARMv8.5A - which this is a specific feature...

Arm Memory Tagging Extension: Security Update

Arm is aware of research papers from academics at VUSec Group, Vrije Universiteit Amsterdam, and CompSec Lab, Seoul National University, which demonstrate how speculative probing can potentially be used to determine Arm Memory Tagging Extension (MTE) allocation tags.

developer.arm.com

 

[DJones]

No - just disable the feature for ARMv8.5A - which this is a specific feature...

Arm Memory Tagging Extension: Security Update

Arm is aware of research papers from academics at VUSec Group, Vrije Universiteit Amsterdam, and CompSec Lab, Seoul National University, which demonstrate how speculative probing can potentially be used to determine Arm Memory Tagging Extension (MTE) allocation tags.

developer.arm.com

The title is just quoting the video.

 

[jerry6]

No - just disable the feature for ARMv8.5A - which this is a specific feature...

https://developer.arm.com/Areveryth... Security Center/Arm Memory Tagging Extension

everything is end of the world these days

 

[RMerlin]

everything is end of the world these days

And many security experts are masterclickbaiters. A lot of them publish incomplete, sometimes out of date information, and push it as if they had just discovered the Holy Grail... I remember a few years ago one of them published a long article about a few CVEs present in Asus routers. His article failed to disclose that all mentionned CVEs were already fixed 6+ months ago.

Linus Torvalds had a few choice words about them a few years ago, and I totally agreed with his opinion back then.

 

[Tech9]

CVEs were already fixed 6+ months ago

Would you be happier if the information published was current with not yet fixed firmware? I strongly believe most of this information is presented after the issue was fixed, no? Otherwise it won't be just educational, but instructions how to exploit the vulnerability.

 

[sfx2000]

And many security experts are masterclickbaiters. A lot of them publish incomplete, sometimes out of date information, and push it as if they had just discovered the Holy Grail... I remember a few years ago one of them published a long article about a few CVEs present in Asus routers. His article failed to disclose that all mentionned CVEs were already fixed 6+ months ago.

Correct - and sometimes these "disclosures" are suspect in other ways - I recall a couple of years back on a set of items for the AMD Zen platform that was a bit suspicious and coupled to trading in AMD stock (short sellers)...

 

[RMerlin]

Would you be happier if the information published was current with not yet fixed firmware? I strongly believe most of this information is presented after the issue was fixed, no? Otherwise it won't be just educational, but instructions how to exploit the vulnerability.

If you publish the information 2 weeks after the issue was fixed and nobody knows yet that it was fixed, then you are doing a service.

If you publish the information 6-12 months after it was fixed and already announced in the changelogs published 12 months ago that it was fixed AND you don't even mention in your article that it was already fixed, generating unnecessary panic, then you are clickbaiting.

 

[Tech9]

don't even mention in your article that it was already fixed

Agree, journalists have to draw attention somehow.

 

[DJones]

I agree clickbate is a problem. With this post I just couldn’t be bothered to deep dive into the details, but it was recent enough to post.

Figured the research paper would be sufficient to those that this matters to, and the video would help those with limited background in arm/Linux to understand the problem a little better.

 

[jerry6]

Agree, journalists have to draw attention somehow.

they have to justify the paycheque they get produce clicks or be gone