Here we are - 3600 which was still under manufacture 2-3 years ago are not get patched. Shame on you AMD, if it is true.
The enterprise models are getting patched but the consumer ones aren’t. Shame on them.
Any news on the “pro” line? They were installed on business PCs and had additional security features built in. For instance there is a 3600 pro model.
Consumer usage is not really concerned by the attack scenario of this vulnerability from what I understand. The prerequisite is to have access to the bios so it’s already game over at this point.
Chip makes should not only treat customer CPUs as possibly-business hardware when adding shit like (Intel) ME, Pluton and (AMD) PSP, but also when patching serious vulnerabilities and providing support!
When you pay for enterprise equipment, you are typically paying a premium for longer, more robust support. Consumer products are less expensive because they don’t get this support.
But they are already pretending for whatever reason that these are suitable for enterprises, by always includingthe aformentioned remote control components!
Agreed, firmware security by chip manufacturers has been underwhelming to say the least and we can blame them for that. But in this specific instance I still don’t see the benefit of a fix for consumer usage. Companies have a responsibility and accountability toward their users, so a fix is due, for personal laptops/PCs the threat is toward the owners themselves (activists, diplomats, journalists, etc.). The latter do not buy second hand equipment, and if the firmware is compromised while they own it, they are already in danger.
The latter do not buy second hand equipment
You are assuming activists are well funded in some way, and that they are not repressed.
This obviously has a benefit for consumer usage too, same as encryption. You’re basically saying consumers don’t need any kind of antivirus either, because it’s not that critical.
This vuln should have been fixed for consumer hardware too, because it basically permanently taints all hardware that is vulnerable to it. And what makes it so hard to release patches for consumer hardware, when patches were already made for the same generations of enterprise hardware? Basically the majority of the work has been done alreadyI’m not saying this is a small issue and nothing should be done. I just noted that the issue is not as big as some other hardware-based vulnerabilities we encountered in the past. And every threat model calls for a corresponding counter-measure.
You are assuming activists are well funded in some way, and that they are not repressed. I’m assuming they are repressed, which is why they have people that buy and configure their equipment and hand it to them so that it hasn’t been tampered with. If you cannot afford that your should use your computer as if it was compromised.
You’re basically saying consumers don’t need any kind of antivirus either Where did I write that?
And what makes it so hard to release patches for consumer hardware. AMD focusing on where its money’s at and OEM/motherboard manufacturers being cheap and lazy and not pushing forward updates when they have them.
Sure, but that feels a little bit like saying “We don’t need guards inside the prison, because we already have them patrolling around the perimeter.”
I like my eBay “business” class machines
AMD has unfortunately a long history of abandoning products before its reasonable on its graphics division. Its not really acceptable, up until earlier this year my NAS/server was running a 3600 and its only for power saving purposes I changed that as its still a very workable CPU in that role.
Er I’m still running a FX-8350 as a gaming machine (not AAA games obviously). I had another one as a host for a few VMs and it was more than enough till the motherboard went. One day I’ll upgrade I guess.
I moved from an FX8350 to a R5 5600G a few years ago, having run it for about 9 years. Initially I didn’t think I’d notice much difference, but frankly it’s an entirely different ballgame.
Oh yeah I plan to update. But only when I really get annoyed.
Single core performance is niiice
Welp, glad I avoided that
Attackers need to access the system kernel to exploit the Sinkclose vulnerability, so the system would have to already be compromised. The hack itself is a sophisticated vector that is usually only used by state-sponsored hackers, so most casual users should take that into account.
So it’s a vulnerability that requires you to.already have been compromised. Hardly seems like news.
I can understand AMD only patching server chips that by definition will be under greater threat. On the other hand it’s probably not worth the bad publicity not to fix more.
That being said it builds up vulnerabilities in anti-cheats to another beautiful crowstrike like domino cluster fuck
It’s important because it allows them to directly modify the CPU’s microcode. Basically, the CPU has its own set of instructions, called microcode, which controls how the chip functions on a physical level. If they manage to change your microcode, even a full system reformat won’t kill the virus; You’ll need to either re-flash the CPU (which is not something the standard user or even power user will know how to do) or replace the entire CPU.
The reason that this is news is because it allows malware to embed itself into the processor microcode once kernel is breached. IE: If it is exploited for compromise, you either have to have the knowledge and hardware to reset the processor microcode manually (Requires an SPI flash tool) or you toss the hardware entirely. There’s no just ‘blow the drive away and reinstall the OS’ solution available.
This sounds weird. I was in the impression that operating systems load updated cpu microcode at every boot, because it does not survive a power cycle, and because the one embedded in the BIOS/UEFI firmware is very often outdated. But then how exactly can a virus persist itself for practically forever?
The OS can’t get to the point of loading cpu microcode without that outdated, embedded microcode. The reason it can persist is because there aren’t a lot of good ways to see what that UEFI microcode actually is once it’s installed. Plus, only the UEFI tells you that it has successfully updated itself. There is no other more authoritative system to verify that against. So the virus could just lie and say it’s gone and you would never know. Hence needing to treat it as the worst case scenario, that it never leaves.
And that introduces a specific type of supply chain threat: someone who possesses a computer can infect their own computer, sell it or transfer it to the target, and then use the embedded microcode against the target, even if the target completely reformats and reinstalls a new OS from scratch.
That’s not going to affect most people, but for certain types of high value targets they now need to make sure that the hardware they buy hasn’t already been infected in the supply chain.
I don’t think it gets to the microcode but the UEFI.
I personally agree. I think it’s being somewhat overhyped. If step one is physical access to get things rolling… like for sure some machines are in more public areas than others. But for me, someone would have to break into my house first, then access my machine, just to run exploits later. The exploit is pretty massive, but I think needs to be tempered with “first they need physical access”. Because physically controlling machines has always been number 1 for security.
AMD published a list with the mitigation on Sinkclose on all their processor ranges, and the ComboPI version that will have a patch:
Basically, reflash spi chips and it’ll be gone, and to be infected by that, person gotta have physical access to hardware he hacks, and physical access is root access as always has been
Nope. You do not need physical access for it, just root access. and you HW is compromised with only means to recover it is SPI flashing of CPU.
custom firmware!
Does not exist for Ryzen because of AGESA licensingnq
Arrrr?
The fuck are you trying to say? Speak English. Also no one at coreboot has publicly released (or developed?) anything for AM4 and you can’t access AGESA code to patch it yourself.
removed by mod
I don’t think they’re suggesting taking it away from the rightful owner.
removed by mod
Acronyms, initialisms, abbreviations, contractions, and other phrases which expand to something larger, that I’ve seen in this thread:
Fewer Letters More Letters IP Internet Protocol NAS Network-Attached Storage SSD Solid State Drive mass storage
3 acronyms in this thread; the most compressed thread commented on today has 4 acronyms.
[Thread #919 for this sub, first seen 12th Aug 2024, 20:35] [FAQ] [Full list] [Contact] [Source code]
deleted by creator
So I have a 3700x, I’ve read about the vulnerability but don’t fully understand it. How at risk am I?
Yes.
If an attacker gets access to your system, they will be able to ensure you can’t get rid of their access
It will persist across operating system installs
However, this requires them to get access first
Sounds like it’s time for an upgrade. Never know what kind of weirdos are out there. Thanks for the information.
In short, if you’re pwned once, you are pwn3d f0r3v#rrrrreeeheehaahaahaa*cough**cough*
These are the kinds of exploits you use to create APT (Advanced Persistent Threats).
If they get root or admin they can hack the chip itself.
But minor exploits, nada, no issue, you good. Gotta get root to make it happen.
Problem is if you, as they say, get got, you have no way of knowing if they’re in your CPU, and no way to fix if they did – basically gotta trash it and replace.
Not particularly. The exploit requires ring 0 access, if an attacker managed to get that, you are screwed already.
removed by mod
wake up samurairemoved by mod
you need a mental evaluation
removed by mod
Can you rub those 2 braincells together any faster might help some not enough probably
please seek help
removed by mod
Yay, another BIOS update!
I am getting so sick of all these BIOS updates because of all these security vulnerabilities all the time. It is so tiring having to set up my settings all over again all of the time. Earlier this year, or maybe it was last year, it felt like every month or two there was a new BIOS update for a new security vulnerability.
Back your settings up and restore them then.
Depending on your BIOS and/or motherboard, you can’t restore them between versions. The point of clearing the BIOS settings after flashing a new version is to ensure that you only have values that are expected, which is why restoring backups can often be blocked between versions.
I learned this the hard way when I lost all my fan profiles
Thankfully that’s one thing that can be restored between BIOS versions for my motherboard lol
Not on mine :(
so that means you can internally flash the bios chip from the os?
would be cool if there were coreboot builds for these platforms, this exploit seems pretty useful
Wait yeah can someone explain why this exploit couldn’t be used to say rewrite it to support coreboot and turn this into a good thing?
because you need the coreboot people to write firmware that can initialise the system, and that probably takes a lot of reverse engineering
I don’t know much about this, but I assume there’s little to no effort for corebooting on the amd side, I’ve only seen intel platforms with coreboot
There are coreboot AMD projects for the framework laptop
Shit, I have desktops running with 2200G and 2400G.
deleted by creator
Some people really don’t think before they speak do they
My threadripper 1950x is from 2017… and is the cpu powering my primary hypervisor perfectly fine. That’s not 18 years ago, that’s not even 8 years ago.
@just_another_person @TheHolm where do you get the 15 year old hardware from?
deleted by creator
What are you on about?
Ryzen 3xxx series processors are still being sold new today
The oldest zen processors are only just over half a decade old—a consumer CPU should be expected to be in service at least double that time.
Support should be 5 years after End of Life or end of Manufacturing date.
AMD is producing them new or your local shop us? Because AMD doesnt care about your local tech shop dead stock.
Maybe they should, and also care about the many people still using these processors that are not very old.
Ryzen 2000 and 3000 are still fairly recent and were announced 5-6 years ago.
The Ryzen 5 3600 is from 2019. The XT refreshes so Ryzen 5 3600xt from mid 2020
They aren’t patching CPUs that were released 5 years ago.
They should be patching back to Ryzen 1 since those are still perfectly good CPUs. 5-7 years really isn’t that old considering how little improvement there is with each generation.
Sure, not much per gen, but if you compare say a 1700x vs the current 9700x, you are roughly looking at a 3x improvement in single and multicore performance increase.
Most of desktop users don’t care at all about these gains. Slap in normal ram and an SSD and a 1000 series Ryzen is ready to be a run of the mill desktop, that browses and can show media no problem.
I care! But I’m a power user. Most aren’t.
I suppose that is true. Intel seems to think so as well as their low power n100 is about the performance of a 1500x.
3600 was released in 2019. And it they was making it for at least 2 years.
