The biggest microcode attack in our history is underway
(theregister.com)
When your state machines are vulnerable, all bets are off
When your state machines are vulnerable, all bets are off
The biggest microcode attack in our history is underway
(theregister.com)
When your state machines are vulnerable, all bets are off
When your state machines are vulnerable, all bets are off
AMD: Microcode Signature Verification Vulnerability
(github.com/google)
Google Security Team has identified a security vulnerability in some AMD Zen-based CPUs. This vulnerability allows an adversary with local administrator privileges (ring 0 from outside a VM) to load malicious microcode patches. We have demonstrated the ability to craft arbitrary malicious microcode patches on Zen 1 through Zen 4 CPUs. The vulnerability is that the CPU uses an insecure hash function in the signature validation for microcode updates.
Google Security Team has identified a security vulnerability in some AMD Zen-based CPUs. This vulnerability allows an adversary with local administrator privileges (ring 0 from outside a VM) to load malicious microcode patches. We have demonstrated the ability to craft arbitrary malicious microcode patches on Zen 1 through Zen 4 CPUs. The vulnerability is that the CPU uses an insecure hash function in the signature validation for microcode updates.