Here we are - 3600 which was still under manufacture 2-3 years ago are not get patched. Shame on you AMD, if it is true.
That’s so stupid, also because they have fixes for Zen and Zen 2 based Epyc CPUs available.
Intel vs. AMD isn’t “bad guys” vs. “good guys”. Either company will take every opportunity to screw their customers over. Sure, “don’t buy Intel” holds true for 13th and 14th gen Core CPUs specifically, but other than that it’s more of a pick your poison.
Tangent: If we started buying risc-v systems we might get to a point where they can actually compete.
That’s still far away from us as a consumer standpoint, but I’m eagerly waiting for a time when I could buy a RISC V laptop with atleast midrange computing capabalities
I‘m more on the builder/tinkerer side so I‘m pretty much in starting position with risc-v now. But yes, its going to be some time before any of it is user ready as a pc.
How is AMD “screwing us over”? Surely they aren’t doing this on purpose? That seems very cynical.
They are 100% not patching old chips intentionally by not allocating resources to it. It’s a conscious choice made by the company, it is very much “on purpose”.
That’s not what I was referring to. I was referring to the act of “adding vulnerabilities”. Surely they aren’t doing that on purpose. And surely they would add fixes for it if it was economically viable? It’s a matter of goodwill and reputation, right?
I don’t know, I just don’t think it’s AMD’s business model to “screw over” their customers. I just don’t.
What I mean by that is that they will take a huge disservice to their customers over a slight financial inconvenience (packaging and validating an existing fix for different CPU series with the same architecture).
I don’t classify fixing critical vulnerabilities from products as recent as the last decade as “goodwill”, that’s just what I’d expect to receive as a customer: a working product with no known vulnerabilities left open. I could’ve bought a Ryzen 3000 CPU (maybe as part of cheap office PCs or whatever) a few days ago, only to now know they have this severe vulnerability with the label WONTFIX on it. And even if I bought it 5 years ago: a fix exists, port it over!
I know some people say it’s not that critical of a bug because an attacker needs kernel access, but it’s a convenient part of a vulnerability chain for an attacker that once exploited is almost impossible to detect and remove.
Attackers need to access the system kernel to exploit the Sinkclose vulnerability, so the system would have to already be compromised. The hack itself is a sophisticated vector that is usually only used by state-sponsored hackers, so most casual users should take that into account.
So it’s a vulnerability that requires you to.already have been compromised. Hardly seems like news.
I can understand AMD only patching server chips that by definition will be under greater threat. On the other hand it’s probably not worth the bad publicity not to fix more.
That being said it builds up vulnerabilities in anti-cheats to another beautiful crowstrike like domino cluster fuck
The reason that this is news is because it allows malware to embed itself into the processor microcode once kernel is breached. IE: If it is exploited for compromise, you either have to have the knowledge and hardware to reset the processor microcode manually (Requires an SPI flash tool) or you toss the hardware entirely. There’s no just ‘blow the drive away and reinstall the OS’ solution available.
This sounds weird. I was in the impression that operating systems load updated cpu microcode at every boot, because it does not survive a power cycle, and because the one embedded in the BIOS/UEFI firmware is very often outdated. But then how exactly can a virus persist itself for practically forever?
And that introduces a specific type of supply chain threat: someone who possesses a computer can infect their own computer, sell it or transfer it to the target, and then use the embedded microcode against the target, even if the target completely reformats and reinstalls a new OS from scratch.
That’s not going to affect most people, but for certain types of high value targets they now need to make sure that the hardware they buy hasn’t already been infected in the supply chain.
Basically, reflash spi chips and it’ll be gone, and to be infected by that, person gotta have physical access to hardware he hacks, and physical access is root access as always has been
Nope. You do not need physical access for it, just root access. and you HW is compromised with only means to recover it is SPI flashing of CPU.
welp, time to go buy intel… wait.
You laugh, but if you’re buying used, this 100% makes Intel the way to go over a Ryzen 1000/2000/3000 CPU.
as long as we’re buying 12th gen, we’re ok.
I dont know.
If I had my choice between a CPU that has a vulnerability that can only be exploited if the system is already compromised
or a CPU that are full of oxidation cancer, or frying themselves and doing irreparable damage… Which the company is being excessively shady about concretely admitting to any RMA promises and wwill all eventually die in short order…
I think I’m gonna go with the Ryzen and not leave leave my computer outside at defcon.
Sure but we’re talking about several generation old CPUs: nothing’s wrong with Intel’s 10/9/8th gen CPUs, which would be the contemporary ones to the Ryzen chips in question.
custom firmware!
Does not exist for Ryzen because of AGESA licensingnq
Arrrr?
The fuck are you trying to say? Speak English. Also no one at coreboot has publicly released (or developed?) anything for AM4 and you can’t access AGESA code to patch it yourself.
Acronyms, initialisms, abbreviations, contractions, and other phrases which expand to something larger, that I’ve seen in this thread:
Fewer Letters More Letters IP Internet Protocol NAS Network-Attached Storage SSD Solid State Drive mass storage
3 acronyms in this thread; the most compressed thread commented on today has 4 acronyms.
[Thread #919 for this sub, first seen 12th Aug 2024, 20:35] [FAQ] [Full list] [Contact] [Source code]
How severe is this vulnerability?
The good news is that in order to exploit the new vulnerability, the attacker first has to obtain kernel level access to the system somehow - by exploiting some other vulnerabilities perhaps.
The bad news is once Sinkclose attack is performed, it can be hard to detect and mitigate: it can even survive an OS reinstall.
So basically what you are saying is we just need one pvp game with kernel level anti cheat to fuck up somewhere… yeah I’m sure that’s not going to happen.
we just need one pvp game with kernel level anti cheat
Leaving aside that security patches should be done, if you install that kind of game on a system where you have any data worth protecting, you’re a dumb ass mtherfcker. Sorry, but seriously, that’s just how it is.
The other bad news: there are so many vulnerabilities on all systems which can be used to gain root-level access, it’s just a matter of time. Also, even future vulnerabilities will be an issue, as the underlying Sinkclose attacks will still work.
Honestly not on a hardened setup
Sure, if you’d rather like to believe that.
If it was that easy to get root then we would be in serious trouble. The best way I can think of is social engineering.
You need to be a root to exploit it, but if it get exploited any way to get rid of it is to throw MB to trash.
Patch/reflash with a new bios?
How do you trust that the flash was done properly if you did it from the compromised system? This would only work if you flashed it externally somehow without the system running.
So I have a 3700x, I’ve read about the vulnerability but don’t fully understand it. How at risk am I?
Not particularly. The exploit requires ring 0 access, if an attacker managed to get that, you are screwed already.
If they get root or admin they can hack the chip itself.
But minor exploits, nada, no issue, you good. Gotta get root to make it happen.
Problem is if you, as they say, get got, you have no way of knowing if they’re in your CPU, and no way to fix if they did – basically gotta trash it and replace.
In short, if you’re pwned once, you are pwn3d f0r3v#rrrrreeeheehaahaahaa*cough**cough*
These are the kinds of exploits you use to create APT (Advanced Persistent Threats).
If an attacker gets access to your system, they will be able to ensure you can’t get rid of their access
It will persist across operating system installs
However, this requires them to get access first
Removed by mod
The enterprise models are getting patched but the consumer ones aren’t. Shame on them.
Consumer usage is not really concerned by the attack scenario of this vulnerability from what I understand. The prerequisite is to have access to the bios so it’s already game over at this point.
Chip makes should not only treat customer CPUs as possibly-business hardware when adding shit like (Intel) ME, Pluton and (AMD) PSP, but also when patching serious vulnerabilities and providing support!
When you pay for enterprise equipment, you are typically paying a premium for longer, more robust support. Consumer products are less expensive because they don’t get this support.
But they are already pretending for whatever reason that these are suitable for enterprises, by always includingthe aformentioned remote control components!
Agreed, firmware security by chip manufacturers has been underwhelming to say the least and we can blame them for that. But in this specific instance I still don’t see the benefit of a fix for consumer usage. Companies have a responsibility and accountability toward their users, so a fix is due, for personal laptops/PCs the threat is toward the owners themselves (activists, diplomats, journalists, etc.). The latter do not buy second hand equipment, and if the firmware is compromised while they own it, they are already in danger.
The latter do not buy second hand equipment
You are assuming activists are well funded in some way, and that they are not repressed.
This obviously has a benefit for consumer usage too, same as encryption. You’re basically saying consumers don’t need any kind of antivirus either, because it’s not that critical.
This vuln should have been fixed for consumer hardware too, because it basically permanently taints all hardware that is vulnerable to it. And what makes it so hard to release patches for consumer hardware, when patches were already made for the same generations of enterprise hardware? Basically the majority of the work has been done alreadyI’m not saying this is a small issue and nothing should be done. I just noted that the issue is not as big as some other hardware-based vulnerabilities we encountered in the past. And every threat model calls for a corresponding counter-measure.
You are assuming activists are well funded in some way, and that they are not repressed. I’m assuming they are repressed, which is why they have people that buy and configure their equipment and hand it to them so that it hasn’t been tampered with. If you cannot afford that your should use your computer as if it was compromised.
You’re basically saying consumers don’t need any kind of antivirus either Where did I write that?
And what makes it so hard to release patches for consumer hardware. AMD focusing on where its money’s at and OEM/motherboard manufacturers being cheap and lazy and not pushing forward updates when they have them.
Really not good enough from AMD. I wonder if Intel wasn’t a complete dumpster fire right now if they would still cut off the fix at Zen 3 (I doubt it). There’s really no reason not to issue a fix for these other than they don’t want to pay the engineers for the time to do it, and they think it won’t cost them any reputational damage.
I hate that every product and company sucks so hard these days.
They did issue a fix: “Buy a new CPU please!”
That’s why they don’t mind the reputation hit. If 1 person swears allegiance to Intel as a result but 2 people buy new AMD chips, they’re still ahead. And people will forget eventually. But AMD won’t forget the Q3 2024 sales figures.
Well, guess who’s not buying next gen Ryzen?
They are doing similar stuff with deliberately delaying Linux driver capabilities for Radeon 7xxx series, to make more GPUs die out faster, by overheating (zero RPM fan until 60°+).
I feel like this is the perfect place for Right to Repair legislation: the product is broken? And it’s outside your support window? Then give customers what they need to make the fix themselves. It’s not good enough to say “meh, guess you gotta buy one of our newer chips then 🤷”
AMD has unfortunately a long history of abandoning products before its reasonable on its graphics division. Its not really acceptable, up until earlier this year my NAS/server was running a 3600 and its only for power saving purposes I changed that as its still a very workable CPU in that role.
