AMD accused of delaying patches and withholding bug bounties

Post LinkedIn

🇨🇳Read original on cnBeta (Full RSS)

#cybersecurity #bug-bountyamdamd

💡Understand the risks of working with hardware vendors' bug bounty programs to protect your research efforts.

⚡ 30-Second TL;DR

What Changed

AMD allegedly took 124 days to address a reported security vulnerability.

Why It Matters

This controversy may damage AMD's reputation within the white-hat hacker community, potentially discouraging future responsible disclosures. It highlights the importance of clear, immutable security disclosure policies for hardware vendors.

What To Do Next

If you are a security researcher, always document bug bounty terms in writing before submitting critical vulnerabilities to hardware vendors.

Who should care:Researchers & Academics

Key Points

•AMD allegedly took 124 days to address a reported security vulnerability.
•The company reportedly modified its bug bounty program terms retroactively.
•A $10,000 reward was withheld from the researcher following the policy change.
•The incident has drawn criticism from the cybersecurity community regarding transparency.

🧠 Deep Insight

Web-grounded analysis with 8 cited sources.

🔑 Enhanced Key Takeaways

•The security researcher involved in the dispute is identified as Paul, also known as MrBruh.
•The vulnerability (CVE-2026-40677) was a Remote Code Execution (RCE) flaw in AMD's auto-updater software, exploitable via a Man-in-the-Middle (MITM) attack due to insecure HTTP downloads and lack of proper certificate/signature validation.
•AMD initially dismissed the reported bug as "out of scope" for its bug bounty program, despite it later receiving a CVSS 4.0 score of 7.7, indicating a significant severity.
•AMD reportedly updated its bug bounty policy after the researcher's public disclosure gained traction, retroactively adding a clause that prohibits researchers from disclosing vulnerability information without AMD's written consent, even for out-of-scope reports.
•The incident has drawn widespread criticism from the cybersecurity community, with experts warning that such corporate actions could undermine the integrity of coordinated vulnerability disclosure and deter future responsible reporting.

🛠️ Technical Deep Dive

The vulnerability (CVE-2026-40677) was a Remote Code Execution (RCE) flaw found in AMD's auto-updater software.
The core issue was that while the updater pulled its update list over HTTPS, the actual executable download links used plain HTTP.
The updater reportedly lacked proper certificate validation or real signature checks before executing downloaded files, making it susceptible to Man-in-the-Middle (MITM) attacks.
An attacker could exploit this by replacing legitimate update files with malicious executables, which would then run with elevated privileges due to the updater's permissions.
Affected mitigated versions include AMD Ryzen Master 2.14.3, AMD µProf 5.3, and AMD Management Console 14.0.0.
Although AMD reportedly reengineered the download code, the new version still uses the CRC32 hash for file validity checks, which is not considered cryptographically secure.

🔮 Future ImplicationsAI analysis grounded in cited sources

AMD's reputation among security researchers may suffer, potentially leading to fewer responsible disclosures.

The perceived retroactive policy change and denial of bounty could discourage researchers from reporting vulnerabilities to AMD, opting instead for public disclosure or selling flaws on the black market.

The incident could prompt other companies to review and clarify their bug bounty program terms to prevent similar disputes.

The controversy highlights ambiguities in bug bounty policies, particularly regarding out-of-scope findings and disclosure requirements, which other companies might seek to address proactively.

Increased scrutiny on corporate ethics in vulnerability disclosure and bug bounty programs is likely.

The debate sparked by this incident could lead to broader industry discussions and calls for more transparent and consistent practices in handling security research and rewards.