AMD accused of making Windows more vulnerable

A new report by the US Computer Emergency Readiness Team (US-CERT) indicates AMD is making Windows unsafe because its graphics drivers do not support Address Space Layout Randomisation (ASLR). This feature shuffles the memory map and storing critical resources in a pseudorandom location to help mitigate attacks, but Microsoft can't turn it on by default because doing so on systems with AMD graphics cards would result in system crashes.

According to a vulnerability notice published by the US Computer Emergency Readiness Team (US-CERT) late yesterday, AMD's graphics drivers are incompatible with ASLR and cause blue-screens when the functionality is enabled. Drivers for graphics boards from rival Nvidia, and those designed for Intel's integrated graphics systems, work fine with ASLR.

According to US-CERT's analysis, the result is that systems are ill-secured against attack. Worse, a feature which should be activated by default in order to provide the most security is disabled and hidden - leaving Microsoft with the blame for security breaches it has already coded protection against.

US-CERT's advice is clear: for server systems with AMD graphics hardware, where video performance is a non-issue, users should consider moving to generic VGA drivers which fully support ASLR. For other users, who specifically bought the AMD graphics board for 3D tasks and intend to use it to its full advantage, US-CERT has only one suggestion: 'If the video adapter on your system is not compatible with EMET "Always on" ASLR, consider using a different video adapter that has ASLR compatible drivers.'

Further details at Bit Tech.