Initial AMD Technical Assessment of CTS Labs Research
community.amd.com
community.amd.com
Also, it looks like they are in-line with releasing fixes (in a couple of weeks) way under the 90 day disclosure timeframe.
But I hope this also puts to rest the claims that the vulnerabilities weren't real or that Trail of Bits were paid to fake their results. AMD is confirming that the PSP exploits could circumvent security and make persistent changes. The fact that an attacker needs to acquire admin access first doesn't mean the exploits aren't serious.
To reiterate, CTS Labs certainly over-hyped the impact, and it's understandable why people reacted as they did. But if this were an Intel ME bug (and such exploits have been found in the past), I doubt as many people would have leaped to criticize an independent auditor or downplay the vulnerability (more than it deserved, that is, since it was over-hyped initially).
1. Whichever third party security firm they hired should be discredited and ashamed.
2. AMD should work with its partners to provide a feature which verifiably and permanently halts the PSP CPU when the BIOS exits POST, for users who do not need the TPM feature.
If they just minimally-patch these specific bugs, within a year some other security company will probably find more. Or worse, next time, malicious actors will find them instead.
Most users should not trust, and should not permit, these secondary "liability cores" to continue to run alongside the x86_64 OS.
90 days is far too long for most issues. I get why the industry likes that; a generous timeframe makes their bug fixing efforts look better. But I'm not sure that it's in anyone else's interests.