AMD Says Patches Coming Soon For Chip Vulnerabilities (securityweek.com)

wiredmikey writes: After investigating recent claims from a security firm that its processors are affected by more than a dozen serious vulnerabilities, chipmaker Advanced Micro Devices (AMD) says patches are coming to address several security flaws in its chips. In its first public update after the surprise disclosure of the vulnerabilities by Israeli-based security firm CTS Labs, AMD said the issues are associated with the firmware managing the embedded security control processor in some of its products (AMD Secure Processor) and the chipset used in some socket AM4 and socket TR4 desktop platforms supporting AMD processors.

AMD said that patches will be released through BIOS updates to address the flaws, which have been dubbed MASTERKEY, RYZENFALL, FALLOUT and CHIMERA. The company said that no performance impact is expected for any of the forthcoming mitigations.

Comments

AMD just needs to force MB makers to push out

[Joe_Dragon]

AMD just needs to force MB makers to push out updates?? And down the road what about cpu bios updates that work on ANY MB?

"Vulnerabilities"

[TimothyHollins]

This was nothing more than a poorly sourced hitpiece.

The list of vulnerabilities require administrator access. I doubt real security researchers would even consider that a vulnerability. There was nothing "disastrous" to report, and the claim by CTS Labs that it would "take 2 years to fix" the reported flaws was nothing short of outright lying. I wouldn't be surprised if Intel recently funded independent Israeli security researchers for goodwill.

http://www.tomshardware.com/ne...

Re:"Vulnerabilities"

[Gaygirlie]

That's ridiculous. A vulnerability is a vulnerability, and these vulnerabilities let a malicious actor install persistent, undetectable badware -- that's pretty fucking bad, IMHO. Yes, the vulns require admin rights, but it's not like there aren't plenty of ways of getting those; you can fool people to install/run something with admin-rights, there are plenty of sysadmins/repair-technicians/etc. who could install such badware on a system, state-sponsored actors almost definitely have a good bunch of unreleased hacks that allow for privilege-escalation and so on.

It's obviously a good thing that AMD is going to patch the vulnerabilities and no, I am not claiming that they are anywhere near as bad as CTS Labs made them out to be, but closing your eyes and going "LALALALALALA" doesn't mean they aren't bad.

Re:Response Intel vs AMD

[mark-t]

First of all, this story has nothing to do with Meltdown or Spectre. It is about a set of AMD-specific bugs. Secondly, AMD wasn't affected by Meltdown. Nobody pretended it wasn't affected by Spectre other than people who didn't understand that when it was mentioned that "AMD was not affected", it was in reference to Meltdown only. The apparent disinformation is not acceptable, but is at least understandable because the news of both was publicly released essentially simultaneously and it would have been easy to misinterpret that AMD was unaffected as applying to both. This should have been more clearly worded in the initial release that made the statement. Nonetheless, a clarification was made when it became apparent that this is what people were believing.

Finally, AMD's response to this is vastly more consumer-friendly than Intel's with respect to their own issues, because it only requires applying patches to existing hardware instead of having to go out and buy new hardware.

AMD, please remove the PSP

[emil]

I do not want a Platform Security Processor, Management Engine, or any other hardware on my CPU that I cannot control.

These products serve absolutely no purpose for the general consumer - they are only useful in enterprise (corporate) environments for centralized control.

I would like the option to destroy the PSP on any CPU that I own.

If you refuse to manufacture CPUs lacking this component, then give customers the ability to request an unlock code that forever physically disables a component that is both dangerous and (to them) irrelevant. The request could work similarly to cell phone programs that unlock bootloaders.

AMD, make no mistake - home users emphatically do not want the PSP.

Re:AMD, please remove the PSP

[DamnOregonian]

This is what I wish people would take away from this :(
Instead, they're too busy trying to ravenously defend AMD's misstep.
We have got to get these closed ring -1 black box processors out of our fucking equipment. It's horse shit.