- Google’s scientists found a vulnerability in AMD zen 1 – 4 chips
- It gives any opportunity to push microcode updates, even malicious
- The error requires a high privilege in advance
AMD processors, from Zen 1 all to Zen 4, carry a greater vulnerability that allows threat actors to push microcode updates on affected chips.
This is according to Google researchers who also released a tool to install the updates or “Jailbreak” device.
Google’s researchers called the vulnerability “entrysign”. They explained that it stems from the way AMD uses AES-CMAC as a hash feature in a signature verification process, which is essentially a cryptographic error as CMAC is designed as a message authentication code. Vulnerability is traced as CVE-2024-56161 and got a severity of 7.2/10 (high).
The researchers also found that AMD used a published example key from NIST documentation all over this time, which helped them forge signatures and install any updates to the microcode they saw appropriately. In theory, a threat actor could abuse the vulnerability to bypass safety mechanisms and trigger information leakage.
In practice, however, it is much more difficult than that. The attackers should have local admin privileges in advance, which is difficult enough on their own. Furthermore, the attacks would only continue until the next system restart.
In any case, Google released an open source tool called ‘Zentool’ that allows security researchers (and unfortunately threat actors to drop custom microcode patches.
It consists of tools for microcode -patch study (including limited separation), microcode -patch -writer, signature and loading. The researchers said they are planning to release details of how to decrypt and encrypt microccode plugs in the future. “A significant part of the ongoing research is focused on building an accurate understanding of AMD microcoding instruction set – the current separation and collection is not always accurate because of this challenge,” the report states.
AMD has released BIOS updates to tackle this vulnerability, so if you fear you may be targeted, be sure to update your systems for versions dated December 17, 2024 or later.
Via Toms Hardware
