There have been numerous elevation of privileges flaws.

I'm more curious if it could through a hypervisor?

@braswelljay must be running Windows. Thanks government.

Heard about this article on a Crosstalk Solutions video today:

https://www.bleepingcomputer.com/news/security/former-ubiquiti-dev-charged-for-trying-to-extort-his-employer/

@fredtx This is really GoDaddy breached. That they were running WordPress is kind of an aside.

@scottalanmiller said in New secret-spilling hole in Intel CPUs sends company patching (again):

If you build in a back door, people will use it.

So tired of Intel's messes.

@gjacobse the article is a little misleading. Linux doesn't provide DNS services. So Linux can't be the issue. Any given Linux distro might have one or more default DNS server options, so Ubuntu or RHEL might have this issue, but Linux itself cannot.

In the article, you have to dig before they mention BIND, a DNS server, as being a problem with this issue. BIND is certainly the de facto standard on Linux and represents a problem for the community and ecosystem, but the article presents it in very much a click bait sort of way.

And then it appears to describe the issue as a protocol issue, not an implementation issue and seems to feel that the issue is just that the protocol used for DNS was insecure.

@gjacobse said in Palo Alto Networks patches critical buffer overflow bug:

Researchers wait 12 months to report vulnerability with 9.8 out of 10 severity rating

Palo Alto Networks patches critical buffer overflow bug in its GlobalProtect VPN.
DAN GOODIN - 11/11/2021, 8:30 AM

About 10,000 enterprise servers running Palo Alto Networks’ GlobalProtect VPN are vulnerable to a just-patched buffer overflow bug with a severity rating of 9.8 out of a possible 10.

Security firm Randori said on Wednesday that it discovered the vulnerability 12 months ago and for most of the time since has been privately using it in its red team products, which help customers test their network defenses against real-world threats. The norm among security professionals is for researchers to privately report high-severity vulnerabilities to vendors as soon as possible rather than hoarding them in secret.

(Click link for remainder of article)

I'm not sure this bolded part can actually be claimed. that's definitely the desired effect, but how can they know that it IS the norm?

@hobbit666 said in AMD Epyc Gen 4 will have 128 cores, 5nm tech:

@pete-s said in AMD Epyc Gen 4 will have 128 cores, 5nm tech:

@obsolesce said in AMD Epyc Gen 4 will have 128 cores, 5nm tech:

What's the price going to be for one of these?

The top of the line AMD Gen 3 today is the 64 core EPYC 7763 2.45 GHz base clock and 3.5GHz turbo boost. 256MB L3 cache and 280W TDP.

That one is $8K list so the 96 core will be north of that. So maybe $12K or so.

With these prices I feel the line in that snippet is a bit false advertising. I wouldn't consider a 12k processor a "General Propose" computer. That would be more a specific use case in workstations 😜

EPYC are server processors, and these are standard general use. Balanced workload use with high thread count for virtualization.

Anything associated with Windows 8 was bound to fail.