5 ms·

It would not be a Summer time end of the week without the obligatory catastrophic flaw or snafu to keep everyone busy.. It looks bad but this phrase looks even

It would not be a Summer time end of the week without the obligatory catastrophic flaw or snafu to keep everyone busy.. It looks bad but this phrase looks even worse for AMD: "No fix planned"[1]. Finally internalizing themselves as the winner and starting to pull an Intel? [1] - https://www.amd.com/en/resources/product-security/bulletin/amd-sb-7014.html https://www.amd.com/en/resources/product-security/bulletin/a...

molyss 2y ago
I'm not sure if the linked pages was updated recently, if I'm completely misreading it or if you're trolling. There's only one processor family (matisse) that's documented as "no fix planned). All datacenter products already have a fix published, and all non-matisse chips will have a new firmware available by october 2024
- Vegenoid 2y ago
  The Ryzen 3000 series ("matisse") is less than 5 years old, with the models coming out in late 2019 and 2020. To not issue a fix for those is very disappointing. I just built a gaming PC with a Ryzen 3600. It is more than sufficient to run modern games with demanding graphics and performance. I now need to learn about this exploit. Yes, if someone gets the level of access required to exploit it I was pwned anyway, but now if I get pwned I need to open up my computer and throw away a perfectly powerful CPU, then put it back together with a new one. That's pretty damn frustrating. It will definitely push me away from AMD when I am making future hardware decision. EDIT: As pointed out by sqeaky and others, there shouldn't be a method for persistence that lives on the processor, instead it would likely be on the motherboard, or in the bootloader on a storage device.
  - gruez 2y ago
    >but now if I get pwned I need to open up my computer and throw away a perfectly powerful CPU, then put it back together with a new one. I don't think there's any indication that the exploit allows the CPU itself to be persistently infected.
    - Vegenoid 2y ago
      From the article: > As a matter of fact, the researchers say that the code would likely survive a complete reinstallation of the operating system. The best option for infected computers would be a one-way ticket to the trash heap. From the Wired article (https://www.wired.com/story/amd-chip-sinkclose-flaw/ https://www.wired.com/story/amd-chip-sinkclose-flaw/): > In fact, for any machine with one of the vulnerable AMD chips, the IOActive researchers warn that an attacker could infect the computer with malware known as a “bootkit” that evades antivirus tools and is potentially invisible to the operating system, while offering a hacker full access to tamper with the machine and surveil its activity. For systems with certain faulty configurations in how a computer maker implemented AMD's security feature known as Platform Secure Boot—which the researchers warn encompasses the large majority of the systems they tested—a malware infection installed via Sinkclose could be harder yet to detect or remediate, they say, surviving even a reinstallation of the operating system. > Only opening a computer's case, physically connecting directly to a certain portion of its memory chips with a hardware-based programming tool known as SPI Flash programmer and meticulously scouring the memory would allow the malware to be removed, Okupski says. Nissim sums up that worst-case scenario in more practical terms: “You basically have to throw your computer away.” Do you have differing information?
      - sqeaky 2y ago
        I have no information that conflicts with what you posted but none of that indicates that the CPU gets written to. Consider that even things like CPU microcode don't get stored on the CPU, it's simply doesn't have persistent storage. CPU microcode is often applied early during OS boots and loaded into memory or CPU cache. What you have quoted indicates something similar, perhaps the main board or other device with storage of some kind is being written to or perhaps an attacker could write a payload that lived entirely in the bootloader on the main storage.
        Vegenoid 2y ago
        Appreciate the clarification, that makes sense. Maybe we'll get more details on potential persistence methods from the talk they'll give tomorrow: https://info.defcon.org/event/?id=54863 https://info.defcon.org/event/?id=54863
  - kmeisthax 2y ago
    If you get code execution in SMM you can flash the BIOS on the motherboard. You'd be junking the mobo (unless it has one of those "BIOS Flashback" setups), not the CPU.
  - outworlder 2y ago
    We need more details before claiming that the sky is falling. Many exploits that are theoretically possible have so many pre-requisites in practice that they don't matter. We need to see if that's the case here. Intel CPUs have been self-destructing, so you need to throw away CPUs even if they aren't pwned. They have also had far more security vulnerabilities than AMD, some of them cannot be patched, and operating systems had to work around them. Heck, the Sinkclose name came from 'Sinkhole', which was an Intel vulnerability. No manufacturer is perfect.
    - Vegenoid 2y ago
      Yes, fair enough. My hasty anger was emotionally driven because I just built a fairly powerful gaming computer with a Ryzen 3600, and because I am perpetually chafed by the hardware treadmill. I still think "no fix planned" for their CPUs that are widely used and <5 years old is ridiculous.
isotypic 2y ago
The "No fix planned" is specifically for just the Ryzen 3000 desktop series. While obviously a fix would be better, given the age of this series as well as the need for ring 0 access to exploit the vulnerability, the actual impact from leaving it unfixed on those CPUs will probably be pretty limited.
- nullifidian 2y ago
  >given the age of this series It's from the Jul 2019. Not very old. CPUs from the early 2010s, with enough ram, are still perfectly usable for light browsing and text editing tasks.
  - arghwhat 2y ago
    Calling 3900 “very old” is stretching it, but they’re certainly “old”. Chips from the early 2010s are very old and inefficient - it’s just that you listed tasks that demand nothing, and if battery power is not required it will certainly do the trick. Being very old and being usable are very things, as any senior person or tech collector will tell you.
    - Vegenoid 2y ago
      > Calling 3900 “very old” is stretching it, but they’re certainly “old”. No, I will contest <5 years old CPUs being called "old". This perspective is warped by the marketing teams of computer hardware companies. There are many 3000 series processors which are perfectly powerful enough for powerful modern software.
      - spencerflem 2y ago
        Totally, I'm chilling with a 2016 skylake i5 and have no desire to upgrade whatsoever.
      - arghwhat 2y ago
        To nitpick, they are not “<5 years”, they are officially more than 5 years and one month old depending on the model. They have been superseded 3 times (5000, 7000 and now 9000), fallen off comparison charts. Even 5000 to 9000 nets you 2x real-world performance for the same power, 3000 was slower and hungrier than that. There is nothing wrong with using or intentionally buying old things that work. But being “powerful enough to run modern software” doesn’t mean more than “is AMD64 and support a minimum of 8GB of RAM”. I also have a 3rd gen intel i7’s laptop that is “powerful enough to run modern software”, but it’s still very old and incredibly power hungry for the little work it does. I also have a 14 year old car that performs its functions as well as when it was new - much to my dismay - but it’s still objectively old.
sqeaky 2y ago
This isn't catastrophic this is clickbait bullshit. The attacker needs ring 0 privileges, this enables someone with kernel level access to right to the firmware. That's not good, but it's not catastrophic either

molyss 2y ago

I'm not sure if the linked pages was updated recently, if I'm completely misreading it or if you're trolling. There's only one processor family (matisse) that's documented as "no fix planned). All datacenter products already have a fix published, and all non-matisse chips will have a new firmware available by october 2024

Vegenoid 2y ago
The Ryzen 3000 series ("matisse") is less than 5 years old, with the models coming out in late 2019 and 2020. To not issue a fix for those is very disappointing. I just built a gaming PC with a Ryzen 3600. It is more than sufficient to run modern games with demanding graphics and performance. I now need to learn about this exploit. Yes, if someone gets the level of access required to exploit it I was pwned anyway, but now if I get pwned I need to open up my computer and throw away a perfectly powerful CPU, then put it back together with a new one. That's pretty damn frustrating. It will definitely push me away from AMD when I am making future hardware decision. EDIT: As pointed out by sqeaky and others, there shouldn't be a method for persistence that lives on the processor, instead it would likely be on the motherboard, or in the bootloader on a storage device.
- gruez 2y ago
  >but now if I get pwned I need to open up my computer and throw away a perfectly powerful CPU, then put it back together with a new one. I don't think there's any indication that the exploit allows the CPU itself to be persistently infected.
  - Vegenoid 2y ago
    From the article: > As a matter of fact, the researchers say that the code would likely survive a complete reinstallation of the operating system. The best option for infected computers would be a one-way ticket to the trash heap. From the Wired article (https://www.wired.com/story/amd-chip-sinkclose-flaw/ https://www.wired.com/story/amd-chip-sinkclose-flaw/): > In fact, for any machine with one of the vulnerable AMD chips, the IOActive researchers warn that an attacker could infect the computer with malware known as a “bootkit” that evades antivirus tools and is potentially invisible to the operating system, while offering a hacker full access to tamper with the machine and surveil its activity. For systems with certain faulty configurations in how a computer maker implemented AMD's security feature known as Platform Secure Boot—which the researchers warn encompasses the large majority of the systems they tested—a malware infection installed via Sinkclose could be harder yet to detect or remediate, they say, surviving even a reinstallation of the operating system. > Only opening a computer's case, physically connecting directly to a certain portion of its memory chips with a hardware-based programming tool known as SPI Flash programmer and meticulously scouring the memory would allow the malware to be removed, Okupski says. Nissim sums up that worst-case scenario in more practical terms: “You basically have to throw your computer away.” Do you have differing information?
    - sqeaky 2y ago
      I have no information that conflicts with what you posted but none of that indicates that the CPU gets written to. Consider that even things like CPU microcode don't get stored on the CPU, it's simply doesn't have persistent storage. CPU microcode is often applied early during OS boots and loaded into memory or CPU cache. What you have quoted indicates something similar, perhaps the main board or other device with storage of some kind is being written to or perhaps an attacker could write a payload that lived entirely in the bootloader on the main storage.
      - Vegenoid 2y ago
        Appreciate the clarification, that makes sense. Maybe we'll get more details on potential persistence methods from the talk they'll give tomorrow: https://info.defcon.org/event/?id=54863 https://info.defcon.org/event/?id=54863
- kmeisthax 2y ago
  If you get code execution in SMM you can flash the BIOS on the motherboard. You'd be junking the mobo (unless it has one of those "BIOS Flashback" setups), not the CPU.
- outworlder 2y ago
  We need more details before claiming that the sky is falling. Many exploits that are theoretically possible have so many pre-requisites in practice that they don't matter. We need to see if that's the case here. Intel CPUs have been self-destructing, so you need to throw away CPUs even if they aren't pwned. They have also had far more security vulnerabilities than AMD, some of them cannot be patched, and operating systems had to work around them. Heck, the Sinkclose name came from 'Sinkhole', which was an Intel vulnerability. No manufacturer is perfect.
  - Vegenoid 2y ago
    Yes, fair enough. My hasty anger was emotionally driven because I just built a fairly powerful gaming computer with a Ryzen 3600, and because I am perpetually chafed by the hardware treadmill. I still think "no fix planned" for their CPUs that are widely used and <5 years old is ridiculous.

isotypic 2y ago

The "No fix planned" is specifically for just the Ryzen 3000 desktop series. While obviously a fix would be better, given the age of this series as well as the need for ring 0 access to exploit the vulnerability, the actual impact from leaving it unfixed on those CPUs will probably be pretty limited.

nullifidian 2y ago
>given the age of this series It's from the Jul 2019. Not very old. CPUs from the early 2010s, with enough ram, are still perfectly usable for light browsing and text editing tasks.
- arghwhat 2y ago
  Calling 3900 “very old” is stretching it, but they’re certainly “old”. Chips from the early 2010s are very old and inefficient - it’s just that you listed tasks that demand nothing, and if battery power is not required it will certainly do the trick. Being very old and being usable are very things, as any senior person or tech collector will tell you.
  - Vegenoid 2y ago
    > Calling 3900 “very old” is stretching it, but they’re certainly “old”. No, I will contest <5 years old CPUs being called "old". This perspective is warped by the marketing teams of computer hardware companies. There are many 3000 series processors which are perfectly powerful enough for powerful modern software.
    - spencerflem 2y ago
      Totally, I'm chilling with a 2016 skylake i5 and have no desire to upgrade whatsoever.
    - arghwhat 2y ago
      To nitpick, they are not “<5 years”, they are officially more than 5 years and one month old depending on the model. They have been superseded 3 times (5000, 7000 and now 9000), fallen off comparison charts. Even 5000 to 9000 nets you 2x real-world performance for the same power, 3000 was slower and hungrier than that. There is nothing wrong with using or intentionally buying old things that work. But being “powerful enough to run modern software” doesn’t mean more than “is AMD64 and support a minimum of 8GB of RAM”. I also have a 3rd gen intel i7’s laptop that is “powerful enough to run modern software”, but it’s still very old and incredibly power hungry for the little work it does. I also have a 14 year old car that performs its functions as well as when it was new - much to my dismay - but it’s still objectively old.

sqeaky 2y ago

This isn't catastrophic this is clickbait bullshit. The attacker needs ring 0 privileges, this enables someone with kernel level access to right to the firmware. That's not good, but it's not catastrophic either