Re: An example of hardware/software vulns - GPUs

[Art Manion <amanion@cert.org>]

On 7/13/17 11:24 AM, Millar, Thomas wrote:

> I think my main goal in having a category of hardware vulnerabilities
> covered by CVE would merely be to ensure that manufacturing or design
> issues that cannot be addressed with complete confidence by a
> software change are enumerated so that security teams can know they
> have a problem that will require a shipping invoice to properly fix,
> so to speak.
Yes -- if I have to replace hardware/silicon to fully remove a 
vulnerability, that should get a CVE ID.  Or if instead of replacing I 
keep the (strictly) vulnerable hardware but apply microcode/firmware 
that mitigates the vulnerability -- CVE ID.

I believe the current counting rules allow this, Kurt, do you disagree? 
 Do we need to change the counting rules?

 - Art