Slashdot Mirror

← Back to Stories (view on slashdot.org)

AMD Says Patches Coming Soon For Chip Vulnerabilities (securityweek.com)

Posted by msmash on from the up-next dept.

wiredmikey writes: After investigating recent claims from a security firm that its processors are affected by more than a dozen serious vulnerabilities, chipmaker Advanced Micro Devices (AMD) says patches are coming to address several security flaws in its chips. In its first public update after the surprise disclosure of the vulnerabilities by Israeli-based security firm CTS Labs, AMD said the issues are associated with the firmware managing the embedded security control processor in some of its products (AMD Secure Processor) and the chipset used in some socket AM4 and socket TR4 desktop platforms supporting AMD processors.

AMD said that patches will be released through BIOS updates to address the flaws, which have been dubbed MASTERKEY, RYZENFALL, FALLOUT and CHIMERA. The company said that no performance impact is expected for any of the forthcoming mitigations.

47 of 84 comments (clear)

  1. AMD just needs to force MB makers to push out by Joe_Dragon · · Score: 3, Insightful

    AMD just needs to force MB makers to push out updates?? And down the road what about cpu bios updates that work on ANY MB?

    1. Re:AMD just needs to force MB makers to push out by F.Ultra · · Score: 2

      They can also push out new microcode updates to the OS vendors, you can get microcode updates via BIOS and via the OS. If you'r on i.g Debian/Ubuntu you can install "amd64-microcode or intel-microcode" depending on if you use an AMD or Intel CPU. Microsoft and Apple probably include them in an update as well.

    2. Re:AMD just needs to force MB makers to push out by DamnOregonian · · Score: 1

      And if someone has already owned the SMU, they can make you think you installed the BIOS, but replace the little blurb of SMU code in it transparently, allowing you to think you've fixed the problem, without actually having done so!
      But no, this isn't a problem.

    3. Re:AMD just needs to force MB makers to push out by F.Ultra · · Score: 1

      However looking at this particular issue this is not a microcode update so it must be done via a BIOS update, sorry for the confusion.

    4. Re: AMD just needs to force MB makers to push out by Brockmire · · Score: 1

      So you think mythical malware that takes advantage of this already has such countermeasures tested and working? You're trying hard.

    5. Re: AMD just needs to force MB makers to push out by DamnOregonian · · Score: 1

      No, I don't...
      But it's not a difficult target if you've got control of the ARM on the AMD CPU.
      I'm not trying hard at all. On the contrary- people are trying really hard to defend this as "not a big deal" and I'm saying it IS. And I'm qualified to say so.

  2. "Vulnerabilities" by TimothyHollins · · Score: 5, Insightful

    This was nothing more than a poorly sourced hitpiece.

    The list of vulnerabilities require administrator access. I doubt real security researchers would even consider that a vulnerability. There was nothing "disastrous" to report, and the claim by CTS Labs that it would "take 2 years to fix" the reported flaws was nothing short of outright lying. I wouldn't be surprised if Intel recently funded independent Israeli security researchers for goodwill.

    http://www.tomshardware.com/ne...

    1. Re:"Vulnerabilities" by Anonymous Coward · · Score: 2, Funny


      The list of vulnerabilities require administrator access. I doubt real security researchers would even consider that a vulnerability.

      It's a vulnerability, it's just not one that warrants much concern. This comic comes to mind, though the caption should be "they can install drivers, replace the entire system, read any file they want, sniff all my packets, login to my facebook, my email, etc.. but at least they can't replace my BIOS, or read super-secret areas of the CPU!"

    2. Re:"Vulnerabilities" by Gaygirlie · · Score: 2, Insightful

      That's ridiculous. A vulnerability is a vulnerability, and these vulnerabilities let a malicious actor install persistent, undetectable badware -- that's pretty fucking bad, IMHO. Yes, the vulns require admin rights, but it's not like there aren't plenty of ways of getting those; you can fool people to install/run something with admin-rights, there are plenty of sysadmins/repair-technicians/etc. who could install such badware on a system, state-sponsored actors almost definitely have a good bunch of unreleased hacks that allow for privilege-escalation and so on.

      It's obviously a good thing that AMD is going to patch the vulnerabilities and no, I am not claiming that they are anywhere near as bad as CTS Labs made them out to be, but closing your eyes and going "LALALALALALA" doesn't mean they aren't bad.

    3. Re:"Vulnerabilities" by upl8n87447 · · Score: 2

      The real problem is that if someone were to get admin access, they could plant the malware where there was no way of finding it.

      Still though, this was clearly a hit piece by CTS Labs in hopes of capitalizing on the fall out. The shorts must be crapping themselves. With how quickly AMD responded with fixes, my bet is that they already knew about it. For something this serious, you not only want to fix the problem, but test the living hell out of it to make sure you're not inadvertently breaking something else.

    4. Re:"Vulnerabilities" by thegarbz · · Score: 1

      A vulnerability is a vulnerability

      You've never heard of the concept of "risk" have you.

    5. Re:"Vulnerabilities" by Gaygirlie · · Score: 1

      A vulnerability is a vulnerability

      You've never heard of the concept of "risk" have you.

      Already addressed that in my comment, but, unsurprisingly, the foam dripping from your mouth as you were about to pop a ragevein must have hindered your reading-comprehension skills.

    6. Re:"Vulnerabilities" by Gaygirlie · · Score: 2

      Badware that cannot be detected or removed by completely formatting the system is still a step worse.

    7. Re:"Vulnerabilities" by MachineShedFred · · Score: 1

      Pull power cable. Plug USB boot drive in. Boot from USB. Flash malicious code to hardware because I'm root on my boot stick.

      No, these vulnerabilities are just fine, according to you.

      --
      Slashdot still doesnâ(TM)t support Unicode after it was added to the HTML standard in 1997.
    8. Re:"Vulnerabilities" by DamnOregonian · · Score: 1

      I doubt real security researchers

      Hi. Real security researcher here. You have no idea what you're talking about. These days, systems that run "higher" than root on the main CPU are ubiquitous from the embedded to desktop range. Getting root/administrator access is only the first step. This presents a single easy target for above-root access to a machine. This is a big deal. Quit shilling.

    9. Re:"Vulnerabilities" by DamnOregonian · · Score: 1

      Right on all accounts. This article dearly needs you modded up.
      The only thing I would change is, "they could also plant malware where there was no way of finding it, or removing it."

    10. Re:"Vulnerabilities" by Gaygirlie · · Score: 1

      Firmware-rootkits, yes, but you seemingly fail to comprehend that the PSP is a completely autonomous system that's running at all times and can access anything and everything, and if the badware reciding there doesn't want you knowing about it, you won't know about it. Firmware-rootkits, the kind mentioned in the article, can be detected. Also, the PSP is running a complete OS of its own, so it can do a lot more sophisticated stuff. Like I said, this is a step worse. No, it's not an entirely new concept or anything, but it just takes the old ideas and moves them even further along. (Not that Intel's ME is any better. Stupid god damn black boxes that shouldn't even exist.)

    11. Re:"Vulnerabilities" by Anonymous Coward · · Score: 1

      Pull power cord.

      Discover that the computer isn't allowing to boot from anything but the HDD.

      Discover that the BIOS is password protected.

      Put USB boot media back in pocket.

      Put on your most disappointed face.

      Don't assume the people trying to keep you out are total idiots.

    12. Re:"Vulnerabilities" by TheRaven64 · · Score: 1

      Think about supply-chain trojans: Someone who has access to your computer before you unpack it can (fairly easily) install malware that is not detectable and is not erased when you re-image the machine. That's probably not a concern for individuals, but for anyone worried about corporate espionage or nation state adversaries, it's a problem.

      --
      I am TheRaven on Soylent News
    13. Re:"Vulnerabilities" by Bert64 · · Score: 2

      If you have physical access you could also:

      clone the drive
      backdoor the existing install
      install a hardware keylogger
      modify the hardware

      and all manner of other things. As many people have said, yes it's a bug but it's nowhere near as serious as people have been claiming.

      --
      http://spamdecoy.net - free throwaway anonymous email - avoid spam!
    14. Re:"Vulnerabilities" by Anonymous Coward · · Score: 1

      Hi,

      Real security researcher, software developer, and system administrator here with 20+ years experience. In the "real world" we call an attacker getting admin access "you're screwed", and gaining access to replace the BIOS or some super-secret part of the chip isn't really much more of a compromise. I'm sure there's _some_ systems out there where this is a "big deal", but for the vast majority of computer owners, system administrators, and corporations, this is a non-event.

      It _is_ a vulnerability, but it's not one that's that massive of a concern. Are you _really_ going to take down your critical system just to patch the BIOS on a machine that if someone got admin access they've already gained all the marbles in the box? In the vast, vast majority of cases the answer is going to be no. And that's generally going to be the correct answer.

      If you really _are_ a security researcher, you're a good example of what's the matter with the security "industry". The people I'm talking about express the attitude that "Security==everything", and security==yes/no. That's foolish. Real security is a series of tradeoffs, and extremely specific to the domain, and is NEVER 100%.

    15. Re:"Vulnerabilities" by hairyfeet · · Score: 2

      Which is why I am SOO HAPPY when shit like this happens, because these "extra chips" that the user doesn't have control over? Need to DIAF. It was a bad idea from conception to execution and the sooner the world realizes that these were only shoehorned in so Hollywood and the big corps could bake in DRM to screw users easier? The quicker we can get these damned things removed and move on.

      If the PTBs want these chips? Let them be in enterprise class units so they can pay for them and everyone else can avoid them like the STDs they are, but there is NO REASON to bake this shit into every PC on the planet and shit like this just illustrates why.

      --
      ACs don't waste your time replying, your posts are never seen by me.
    16. Re:"Vulnerabilities" by thegarbz · · Score: 1

      the foam dripping from your mouth

      Not foam, just a TL;LD.

      I don't really get worked up about much, not even enough to read to the end of most sentences.

    17. Re:"Vulnerabilities" by Anonymous Coward · · Score: 1

      Who's the idiot? You. No doubt. "OMG OMG THE SKY IS FALLING!!! UNKNOWN LITTLE MEN ARE GOING TO SHOW UP EVERYWHERE AND PWN EVERYTHING!"

      Jesus Christ. If major companies doesn't use BIOS passwords, that's on them, for starters. Exactly how you're going to get onto their premises and why you think they'd leave you alone to fiddle with their computers, I leave for you to explain further.

      Finally, yes, I suppose if you infiltrated the supply line you'd get a free reign, but you still have utterly failed, every time when asked to, to explain how this is different when we are talking about AMD as opposed to anyone else. The rule is, if you have physical access to the hardware, it's game over.

      NO MATTER WHO MADE THE HARDWARE!

      Fucking moron. Running around, yelling at the top of your lungs and kicking in open doors, pretending it's a fucking huge deal. STFU.

    18. Re:"Vulnerabilities" by DamnOregonian · · Score: 1

      You're completely full of shit, or grossly ignorant. I suspect the latter- you're simply out of your league, here.
      I suspect you don't really know much about secure zones in processors.
      To start, replacing the BIOS in a virus isn't really feasible. The possible variations the virus must contend with (BIOS/EFI variations) in order to put in a custom owned BIOS really only leaves room for very custom jobs.
      The PSP however is fixed. If you have an AMD processor, the PSP can be owned with a simple root exploit, and owned forever, knowing nothing more than that about the system.
      You're what's wrong with this fucking country- people who speak from positions of knowledge when they have none.

  3. Re:Response Intel vs AMD by Fly+Swatter · · Score: 1

    Nice try, but these don't look related to meltdown or spectre at all. It's a problem with their 'secure' management layer, intel already fixed theirs a while back - what took AMD so long :P

  4. Re:Response Intel vs AMD by mark-t · · Score: 4, Insightful
    First of all, this story has nothing to do with Meltdown or Spectre. It is about a set of AMD-specific bugs. Secondly, AMD wasn't affected by Meltdown. Nobody pretended it wasn't affected by Spectre other than people who didn't understand that when it was mentioned that "AMD was not affected", it was in reference to Meltdown only. The apparent disinformation is not acceptable, but is at least understandable because the news of both was publicly released essentially simultaneously and it would have been easy to misinterpret that AMD was unaffected as applying to both. This should have been more clearly worded in the initial release that made the statement. Nonetheless, a clarification was made when it became apparent that this is what people were believing.

    Finally, AMD's response to this is vastly more consumer-friendly than Intel's with respect to their own issues, because it only requires applying patches to existing hardware instead of having to go out and buy new hardware.

    --
    File under 'M' for 'Manic ranting'
  5. Re:Intel by Gaygirlie · · Score: 1

    There was this Ars Technica-article at https://arstechnica.com/gadget... that talks about it, but unfortunately the article doesn't mention any dates. It's a couple of weeks old now, so the microcodes have possibly started to circulate via Windows Update by now?

  6. Re:Response Intel vs AMD by Khyber · · Score: 4, Informative

    "It is about a set of AMD-specific bugs"

    No, no it is not. It's about a set of bugs in a specific range of ASMedia chipsets that AMD uses in their products, which are also in use on plenty of Intel motherboards, which means they're likely just as vulnerable.

    --
    Still waiting on Serviscope_minor to wake up to fucking reality and realize that Jessica Price isn't going to fuck him.
  7. Sure by ArchieBunker · · Score: 2

    You just have to buy a new CPU, motherboard, and RAM.

    --
    Only the State obtains its revenue by coercion. - Murray Rothbard
  8. AMD, please remove the PSP by emil · · Score: 3, Insightful

    I do not want a Platform Security Processor, Management Engine, or any other hardware on my CPU that I cannot control.

    These products serve absolutely no purpose for the general consumer - they are only useful in enterprise (corporate) environments for centralized control.

    I would like the option to destroy the PSP on any CPU that I own.

    If you refuse to manufacture CPUs lacking this component, then give customers the ability to request an unlock code that forever physically disables a component that is both dangerous and (to them) irrelevant. The request could work similarly to cell phone programs that unlock bootloaders.

    AMD, make no mistake - home users emphatically do not want the PSP.

    1. Re:AMD, please remove the PSP by DamnOregonian · · Score: 4, Insightful

      This is what I wish people would take away from this :(
      Instead, they're too busy trying to ravenously defend AMD's misstep.
      We have got to get these closed ring -1 black box processors out of our fucking equipment. It's horse shit.

    2. Re:AMD, please remove the PSP by Bert64 · · Score: 2

      Or provide a PSP that users can control and load their own software onto, or disable if they wish.

      Home users may not want it, but large vendors absolutely do want it to enforce drm and other user-hostile "features".

      --
      http://spamdecoy.net - free throwaway anonymous email - avoid spam!
    3. Re:AMD, please remove the PSP by sl3xd · · Score: 1

      I do not want a Platform Security Processor, Management Engine, or any other hardware on my CPU that I cannot control.

      These products serve absolutely no purpose for the general consumer - they are only useful in enterprise (corporate) environments for centralized control.

      Mass production means we get features we don't need. CPU's and motherboards are designed to suit all buyers. It's cheaper to include the feature everywhere than it is to support an additional model.

      Even in the 1990's, manufacturers were including features the customer didn't want (like integrated sound and video hardware), because it was cheaper to standardize across the board than to provide a different model that doesn't have it. I'm not sure it's even possible to get an Intel or AMD motherboard without integrated graphics and video.

      If you refuse to manufacture CPUs lacking this component, then give customers the ability to request an unlock code that forever physically disables a component that is both dangerous and (to them) irrelevant.

      Provide an avenue for malware to physically destroy hardware? That's an even worse idea.

      --
      -- Sometimes you have to turn the lights off in order to see.
    4. Re:AMD, please remove the PSP by DamnOregonian · · Score: 1

      I have multiple published CVEs in the NVD. One is a root escalation in Android/Linux.
      I'm not mischaracterizing this. People are trying to downplay it, because they've either got an agenda, or they're simply ignorant fanchildren.

      Linus isn't ignorant... I'd say he's more in-line with a delusional fanchild.
      The premise for his argument as to whether this is a big deal or not hinges on the vileness of the lab that found the problems (which who can argue with? those guys are slime) and the fact that an administrator must apparently be "grossly negligent" in order to allow someone to get root on a system running Linux... Which, excuse me while I laugh.

  9. Re:Response Intel vs AMD by Anonymous Coward · · Score: 1

    BIOS rootkits aren't new. In fact, they're extremely old. They're also trivially mitigated by disabling BIOS flashing from within your BIOS, and only turning the feature on when you intend to flash. This is basic hardening that I dearly hope most sysadmins do.

  10. Re:Response Intel vs AMD by alvinrod · · Score: 4, Informative

    It's even a little bit more constrained than that. It's about a set of bugs that require admin rights to exploit in a specific range of ASMedia chipsets that AMD uses in their products.

    For these to be a problem for you, you've probably already got a bigger set of problems. That doesn't mean that they shouldn't be patched, but that a far bigger deal has been made over this than necessary.

  11. Re:Response Intel vs AMD by DamnOregonian · · Score: 2

    That's partially true. The flaws affect both the ASMedia chips, and the embedded ARM system management processor in the CPU. Parent was not wrong.

  12. Re:Intel by DamnOregonian · · Score: 1

    That is the most transparent whataboutism I have ever seen.... I suppose at least you're honest.
    Can you help me understand why the blatent defensive shilling for AMD? It's cancerous here.

  13. Re:Response Intel vs AMD by DamnOregonian · · Score: 2

    You're wrong on a lot of levels.
    First, this does absolutely affect the AMD CPUs (as well as the ASMedia chipset controllers)
    Second, an exploited administrator account is not a bigger deal than an owned chipset or system management controller.
    You are free to run any code you want on your main CPU. The SMU requires signed code for a very good reason- because it can transparently prevent you from actually updating its code, and transparently do... well, whatever the fuck it wants, up to and including preventing you from knowing it is there. There are no bigger problems than flaws at this level.

  14. Re:Response Intel vs AMD by postbigbang · · Score: 1

    Did you read the vulnerability, and how it is instantiated? Of do you just play a geek on TV?

    --
    ---- Teach Peace. It's Cheaper Than War.
  15. Re: Response Intel vs AMD by postbigbang · · Score: 1

    Good grief.

    What if there are actual facts inside? Would that interest you?

    --
    ---- Teach Peace. It's Cheaper Than War.
  16. Re: Response Intel vs AMD by postbigbang · · Score: 1

    Go to: https://blog.trailofbits.com/2... then here: https://community.centminmod.c...

    Enjoy.

    --
    ---- Teach Peace. It's Cheaper Than War.
  17. Re:Intel by Highdude702 · · Score: 1

    It's almost like trump owns AMD as much hate as they get online..

  18. Re: Response Intel vs AMD by Brockmire · · Score: 1

    I just updated a mobo's bios last updated in 2012. It doesn't support downgrading after installing a bios from a certain point. That wasn't the first mobo with downgrade prevention I've seen, either. I don't think you know wtf you're talking about.

  19. Re: Response Intel vs AMD by postbigbang · · Score: 1

    Did it have an onboard PSP? Did it need auth to that PSP? Did it use any security co-processor? That's the point. Right now you can bypass the auth. Anything could be there, and you would have NO way of finding it. Go ahead and install a new BIOS. The new BIOS still can't see what's on that PSP. Downgrade prevention isn't the problem. It's that you can't audit what's there, and code in the PSP prior to the BIOS install *will still be executed* unless you cut off the PSP entirely, and that's not gonna happen because doing so disables a lot of functionality in the processor.

    --
    ---- Teach Peace. It's Cheaper Than War.
  20. Re:Intel by DamnOregonian · · Score: 1

    The rabid AMD defenders who amazingly shit all over Intel when they had the same fucking problem in their IME, but try to act like this isn't an issue definitely remind of Trump Trolls.