The RCE that AMD wouldn't fix

This story details a white-hat hacker's journey from mild annoyance to uncovering a critical security flaw in AMD's AutoUpdate software and the ensuing, often frustrating, disclosure process. What began with an irritating console pop-up quickly escalated into the discovery of a Remote Code Execution (RCE) vulnerability, highlighting significant shortcomings in AMD's security practices and bug bounty program.

• Vulnerability Discovery: The author, MrBruh, decompiled AMD's AutoUpdate application out of frustration, discovering that while the update URL was HTTPS, the executable download URLs embedded within an XML configuration file were plain HTTP. This allowed for trivial Man-in-the-Middle (MITM) attacks to swap legitimate updates with malicious code, further compounded by the software's complete lack of signature verification for downloaded executables.
• Initial AMD Response: Despite the severity, AMD's bug bounty program initially closed the report as 'out of scope', stating that MITM attacks were not covered by their terms of service.
• Public Disclosure & AMD's Reversal: Following a public blog post, AMD's Product Security Incident Response Team (PSIRT) backtracked, acknowledging the validity of the report and requesting the blog post be taken down, which MrBruh initially agreed to.
• Extended Embargo & Disclosure Issues: AMD then imposed an unusually long embargo period (124 days) for a fix, citing that multiple products were affected and customers needed time. MrBruh noted the fix could be as simple as adding an 's' to HTTP URLs, questioning the delay.
• The Ironic Kicker: It was later discovered that the AutoUpdate functionality was already broken due to its inability to handle a domain redirect, effectively making the RCE unexploitable until the updater itself was fixed. This created a Catch-22 situation.
• Flawed Fix Implementation: AMD eventually implemented a fix, moving the auto-updater functionality to the application layer and using HTTPS. However, their claim of 'signature verification' was found to be a weak CRC-32 check, not cryptographically secure hashing.
• No Compensation: Despite discovering multiple critical vulnerabilities for major tech companies, MrBruh highlighted receiving $0 in bug bounties, with the AMD vulnerability alone being potentially worth ~$10,000 had it been in scope.

This saga serves as a stark reminder of the challenges faced by security researchers and the often-bureaucratic, and sometimes incompetent, responses from large corporations to critical security disclosures, ultimately leaving users vulnerable for extended periods.