{"id":10051,"date":"2022-02-05T05:15:55","date_gmt":"2022-02-05T05:15:55","guid":{"rendered":"https:\/\/mailinvest.blog\/index.php\/2022\/02\/05\/intel-expands-its-bug-bounty-program-says-its-cpus-are-safer-than-amds\/"},"modified":"2022-02-05T05:15:55","modified_gmt":"2022-02-05T05:15:55","slug":"intel-expands-its-bug-bounty-program-says-its-cpus-are-safer-than-amds","status":"publish","type":"post","link":"https:\/\/mailinvest.blog\/index.php\/2022\/02\/05\/intel-expands-its-bug-bounty-program-says-its-cpus-are-safer-than-amds\/","title":{"rendered":"Intel Expands its Bug Bounty Program, Says its CPUs are Safer than AMD’s"},"content":{"rendered":"

<\/a>\n<\/p>\n

This site may earn affiliate commissions from the links on this page. Terms of use<\/a>.<\/div>\n
\n
\n
\n \t \t \"\"<\/div>\n<\/p><\/div>\n

Intel Corp. is calling on \u201celite hackers\u201d to join its newly expanded bug bounty program, dubbed Project Circuit Breaker. The new program will allow these individuals to work side-by-side with Intel engineers as they work to discover security flaws in the company\u2019s CPUs, chipsets, drivers, and firmware. In announcing the new initiative the company also released a 2021 security report describing the types of vulnerabilities it discovered last year, the severity of them, and how many they discovered internally versus externally. Intel also compares itself with AMD in the report, noting that fewer security vulnerabilities were found in its processors compared to AMD.<\/p>\n

Its Circuit Breaker<\/a> program, which was flagged by Wccftech<\/a>, is essentially an Olympics of hacking, as top hackers compete with each other to win prizes, climb the leader board, and pull off righteous hacks on Intel\u2019s hardware and software. Intel says it will offer challengers months of training including Capture the Flag competitions, bounty multipliers up to 4x, and access to beta hardware and software. On the program\u2019s landing page, Intel spells out what it\u2019s looking for in terms of hacker qualities, and says it will be revealing more in the coming months about how to join the program.<\/p>\n

\"\"<\/p>\n

Its 2021 Security Report<\/a> is full of interesting data points. Intel goes to great lengths to point out its commitment to finding and fixing vulnerabilities whether it\u2019s done in-house or through external researchers. It says the total number of Common Vulnerabilities and Exposures (CVE) that were found in 2021 was 226, with 50 percent of them discovered by Intel engineers. The following chart shows which platforms had the most CVEs.<\/p>\n

\"\"<\/p>\n

Intel CVE by category, 2021. (Image: Intel)<\/p>\n<\/div>\n

Intel only lists two of the CVEs it discovered as \u201ccritical,\u201d with 52 being \u201chigh,\u201d 147 listed as \u201cmedium,\u201d and 25 as low danger. You\u2019ll no doubt note the unusually high number of vulnerabilities in GPUs, and you might think that\u2019s from Intel\u2019s very own GPUs, which are embedded in the CPU die. But alas, a lot of them are actually AMD\u2019s fault. According to the report, \u201c23 of the 37 vulnerabilities in the Graphics Processing Units category were in third party components, shipped as part of an Intel platform, which links to the CVE page describing the vulnerabilities found in AMD\u2019s VegaM<\/a> GL graphics chip. Back in 2017, Intel shipped Kaby Lake G, which was a platform featuring an Intel CPU with a separate Vega graphics die designed by AMD, backed by 4GB of HBM memory. This was back when Intel had only one plus sign after 14nm, and AMD was still using Global Foundries to make its GPUs.<\/p>\n

On the CPU front, Intel says in 2021 it found just 16 CVEs in its CPUs, compared to 31 for AMD, thus its CPUs are safer. However, there is a caveat here, which is that Intel doesn\u2019t have access to AMD\u2019s internal security reports, so it\u2019s only reporting what has been found by external research teams. Still, AMD\u2019s number is obviously higher, so adding anything internally from AMD would just make the number go up.<\/p>\n

\"\"<\/p>\n

Intel vs. AMD CVE comparison for 2021. (Image: Intel)<\/p>\n<\/div>\n

Taken together, counting both CPUs and GPU CVEs, Intel lists itself as having more vulnerabilities than AMD, however. It says in its report it\u2019s comparing itself to AMD because both companies offer these products, so it can be compared. In total, Intel rung up 67 CVEs in 2021 across both markets, with 16 on the CPU side and 51 on the GPU side. AMD is listed as being responsible for 58, broken up by 31 for its CPUs, and 27 for its GPUs.<\/p>\n

Intel says nothing about how severe the AMD bugs were versus its own, only that there were more bugs found on AMD CPUs. Severity matters too, as far as evaluating the overall impact on a CPU or platform \u2014 but even severity is not enough. Some of the speculative execution bugs of the past few years have been flagged as top-level security problems, but no publicly known hacking group appears to be attempting to exploit Spectre-type speculative execution errors to exfiltrate data out of CPUs. In some cases a problem can be rated \u201cCritical\u201d but have little to no real-world impact due to the practical difficulty of taking advantage of it.<\/p>\n

Now Read<\/strong>:<\/p>\n<\/div>\n