Our colleagues from TechPowerUP, citing a publication in the Dutch press, , reported that Intel attempted to bribe researchers who uncovered MDS vulnerabilities. The microarchitectural data sampling (MDS) vulnerabilities, in Intel processors available for the last 8 years, were discovered by security experts from the Vrije Universiteit Amsterdam (VU Amsterdam). According to a publication in Nieuwe Rotterdamsche Courant, Intel offered researchers a 'reward' of $40,000, plus an additional $80,000 for 'mitigating the threat' posed by the discovered 'hole'. The researchers, the source continues, declined all the money.
Basically, Intel did nothing out of the ordinary. After the discovery of the Spectre and Meltdown vulnerabilities, the company launched a Bug Bounty program to reward those who identify dangerous vulnerabilities in Intel platforms and report them to the company. An additional and mandatory condition for receiving the reward is that no one besides specially appointed Intel personnel should know about the vulnerability. This way, Intel buys time to mitigate the threat — it creates patches and collaborates with OS developers and component manufacturers, for instance, by providing code for BIOS updates.
In the case of the MDS vulnerabilities, Intel had virtually no time for immediate threat mitigation. Although patches by the time the new vulnerabilities were reported, Intel did not manage to fully update the processor microcode, and these procedures are still pending. It is unlikely that the company intended to hide the threat identified by the VU Amsterdam team with a 'bribe' forever, but it certainly could buy itself some maneuvering time.
Source: 3dnews.ru
