- AMD Advisory warns of a new security error with high difficulty
- The error affects Zen 1 to Zen 4 CPUs
- Abuse can lead to loss of SEV-based protection of a confidential guest
Chipmaking giant AMD has confirmed that it has recently patched a vulnerability with high severity affecting its Zen 1 to Zen 4 CPUs.
The company published a new security advice that detailed the mistake and its potential for exploitation, and noted, ”Researchers from Google have provided AMD information about a potential vulnerability that, if successfully exploited, could lead to loss of SEV-based protection of a Confidential guest. “
SEV is an abbreviation for safe encrypted virtualization – a hardware -based security feature designed to improve the confidentiality and integrity of virtual machines (VMs) running on AMD EPYC processors. It encrypts the memory of individual World Cup using unique encryption keys, ensuring that neither the hypervisor nor other World Cup can access their data.
Mitigations available
Vulnerability is traced as CVE-2024-56161 and has a severity of 7.2/10 (high). It is described as an incorrect signature verification error in AMD CPU ROM -Microcode -Patch -loader, which can give threat actors with local admin privileges to load malicious CPU microcode. As a result, the confidentiality and integrity of a confidential guest driving under AMD SEV SNP would be lost.
“AMD has made a mitigation available for this problem that requires updating microcode on all affected platforms to help prevent an attacker from loading malicious microcode,” the company concluded.
“In addition, a SEV company update is required for some platforms to support SEV SNP certificate. Updating System BIOS image and restarting the platform enables the matrimension. A confidential guest can verify that the mitigation is activated on the target platform through the SEV SNP certificate report. “
The company only revealed the public error recently, but the patch was actually released in mid -December 2024. AMD decided to postpone the message to give its customers enough time to mitigate the problem.
