Asus mentioned an AMD microcode bug in the latest patch notes The error was not yet disclosed by the processor manufacturer AMD has since confirmed the news
AMD has apparently confirmed the existence of a microcode vulnerability apparently accidentally spilled from PC maker Asus.
Security researcher Tavis Ormandy recently discovered a BETA bios fix for a “microcode signature verification vulnerability” apparently plaguing Asus’ gaming motherboards, which is mentioned in the company’s release notes.
This was quite strange as AMD had not mentioned any such vulnerability at the time.
Confirmation from AMD
“It appears that an OEM has leaked the patch for a major upcoming CPU vulnerability ie: ‘AMD Microcode Signature Verification Vulnerability’,” Ormandy said. “I’m not excited about this. The patch is currently not in linux firmware, so this is the only publicly available patch.”
Microcode can be described as a set of small instructions stored inside a processor that tell it how to perform specific tasks. It works behind the scenes to help the processor understand and execute more complicated commands.
After the community started asking questions, Asus edited the notes to remove mention of AMD’s microcode issue. Meanwhile, the chipmaker told The register that Asus’ information was correct:
“AMD is aware of a recently reported processor vulnerability. Execution of the attack requires both local administrator-level access to the system and the development and execution of malicious microcode,” it said.
The company also suggested that exploiting the flaw requires victims to be tricked into taking action.
“AMD has provided restrictions and is actively working with its partners and customers to implement these restrictions,” it added. “AMD recommends that customers continue to follow industry standard security practices and only work with trusted vendors when installing new code on their systems. AMD plans to issue a security bulletin soon with additional guidance and remediation options.”
At press time, there was no information about the processor models affected by this vulnerability.
Via The register
You also like
