AMD confirms processor security flaws after Asus patch slips out early

(Image credit: Future)

Asus mentioned an AMD microcode flaw in recent patch notes
The flaw was not yet publicized by the processor manufacturer
AMD has since confirmed the news

AMD has seemingly confirmed the existence of a microcode vulnerability which apparently spilled, unintentionally, from PC maker Asus.

Security researcher Tavis Ormandy recently spotted a BETA bios fix for a “microcode signature verification vulnerability” apparently plaguing Asus’ gaming motherboards, being mentioned in the company’s release notes.

This was quite strange, since at the time AMD had made no mention of any such vulnerability.

Confirmation from AMD

"It looks like an OEM leaked the patch for a major upcoming CPU vulnerability, ie: 'AMD Microcode Signature Verification Vulnerability,'" Ormandy said. "I'm not thrilled about this. The patch is not currently in linux-firmware, so this is the only publicly available patch."

Microcode can be described as a set of small instructions stored inside a processor that tells it how to do specific tasks. It works behind the scenes to help the processor understand and carry out more complicated commands.

After the community started asking questions, Asus edited the notes to remove mentioning AMD’s microcode issue. In the meantime, the chipmaker told The Register that Asus’ information was correct:

"AMD is aware of a newly reported processor vulnerability. Execution of the attack requires both local administrator level access to the system, and development and execution of malicious microcode," it said.

The company also suggested abusing the bug requires the victims being tricked into action.

"AMD has provided mitigations and is actively working with its partners and customers to deploy those mitigations,” it added. “AMD recommends customers continue to follow industry-standard security practices and only work with trusted suppliers when installing new code on their systems. AMD plans to issue a security bulletin soon with additional guidance and mitigation options."

At press time, there was no information about the processor models affected by this vulnerability.

Via The Register

Some of the most iconic AMD chips have a serious security flaw — which the company says it probably won't patch now
Here's a list of the best antivirus tools on offer
These are the best endpoint protection tools right now

TOPICS

Sead is a seasoned freelance journalist based in Sarajevo, Bosnia and Herzegovina. He writes about IT (cloud, IoT, 5G, VPN) and cybersecurity (ransomware, data breaches, laws and regulations). In his career, spanning more than a decade, he’s written for numerous media outlets, including Al Jazeera Balkans. He’s also held several modules on content writing for Represent Communications.