Massive security hole in CPU's incoming?Official Meltdown/Spectre Discussion Thread

[igor_kavinski]

As I like naive questions: is it even possible to flash old microcode on a recently bought CPU?

Maybe with MSI mobos since many users have been running AVX-512 workloads on old Alder Lake CPUs that way, before the newer steppings and later models got their AVX-512 balls physically fused off.

Someone should make a meme of Darth Vader slicing off Alder Lake's AVX-512 balls with his lightsaber.

 

[Hitman928]

AMD’s turn again.

AMD's 'Sinkclose' vulnerability affects hundreds of millions of processors, enables data theft — AMD begins patching issue in critical chip lines, more to follow

Almost cannot be fixed, say researchers.

www.tomshardware.com

The good news: the attacker has to have complete control of your system to begin with.

The bad news: if infected, you can’t remove it by standard anti-virus methods, including wiping the drive clean.

 

[Markfw]

The good news: the attacker has to have complete control of your system to begin with.

Almost impossible to infect any cloud or enterprise servers, unless the data center managers are incompetent.

And a home user would also have to be pretty stupid.

 

[igor_kavinski]

Still, one more mandatory BIOS update.

*groan*

 

[DrMrLordX]

Almost impossible to infect any cloud or enterprise servers, unless the data center managers are incompetent.

And a home user would also have to be pretty stupid.

The researchers claim that state-level actors could utilize the attack. But honestly if they have that level of access to your machine, you're kinda screwed anyway.

 

[johnsonwax]

Almost impossible to infect any cloud or enterprise servers, unless the data center managers are incompetent.

I think you overestimate the rigor of internal practices of OEMs.

 

[JustViewing]

Still, one more mandatory BIOS update.

*groan*

Why it is impossible to check if it is infected or not ? Couldn't the BIOS flashing tool check the version and its content of the existing BIOS and compare it with the correct version downloaded from motherboard web site? Should be easy to check since BIOS flash tools also allows to take backup. Am I missing something?

 

[igor_kavinski]

Am I missing something?

It's not the BIOS but rather the AMD equivalent of "Intel Management Engine" that gets compromised. There should be a way of detecting that and maybe AMD will give such guidance to the OEMs at a later date.

From Tom's:

Once this access is secured, the Sinkclose vulnerability allows the perpetrators to install bootkit malware that evades detection by standard antivirus tools, remaining nearly invisible within the system and can persist even after the operating system is reinstalled.

So something would need to be implemented at the UEFI level for such detection. But I think right now AMD wants to close the loophole instead because they believe such infections are possibly extremely rare. I do think that they should create the UEFI detection mechanism too otherwise it could lead to future bad publicity.

 

[PingSpike]

They should just give us a way to completely disable the management engines so the buggy back doors can be turned off.

 

[ridham05]

do not see, why AMD would not be affected. The attacks rely on runtime-difference of page table walks depending on if the page is mapped or not. This way an attacker could potentially figure out the page mappings for the kernel even though KASLR is in place.
However there must be runtime differences for AMD as well unless it can figure out if a page is mapped before the pagetable walk - which i think is impossible.

 

[moinmoin]

The bad news: if infected, you can’t remove it by standard anti-virus methods, including wiping the drive clean.

That's real bad news btw. since it also affects sales of used CPUs. I really hope AMD handles this right and at the very least offers some fail proof way to detect affected SMMs regardless of how old the CPU is, even if they are unsupported and won't get any fix anymore.

 

[JustViewing]

If hackers can write their own code, so can the MB tools. If you suspect it is infected, you can overwrite it with MB Tools to make sure it is clean.

 

[cebri1]

https://www.tomshardware.com/pc-components/cpus/amd-wont-patch-all-chips-affected-by-severe-data-theft-vulnerability-ryzen-1000-2000-and-3000-will-not-get-patched-among-others

Yikes

 

[moinmoin]

Yeah no, that's no good. AMD has to show significantly more commitment on that matter than that.

 

[DrMrLordX]

Yeah no, that's no good. AMD has to show significantly more commitment on that matter than that.

Hmm. I kinda agree, but I'm sure their suits have a reason, even if that reason kinda sucks. Like "this CPU is out of warranty". Or whatever. Would it really cost them that much to plug the hole on AM4 across the board? I should think not!

 

[igor_kavinski]

The real issue is people buying 2nd hand CPUs or those from Ali Express. Who's to say that the SMM on these CPUs isn't already compromised??? AMD needs to provide a detection tool or mechanism.

 

[PingSpike]

It isn't clear to me if it persists on the CPU or the motherboard. Both would be bad.

 

[Steltek]

It isn't clear to me if it persists on the CPU or the motherboard. Both would be bad.

The way I read it is that the CPU is used to, via SMM, access a sensitive persistent memory area of the the motherboard UEFI BIOS at a specific point during the boot process, explaining why physical access is needed. That CPU access is then used to inject malicious software via SMM into the UEFI in an area that is persistent and which can't be scanned or accessed at any other time.

So, it would seem to me that once this is done, the motherboard itself is infected with malware in a persistent memory area of the UEFI.

This is my take, anyway.

Further, the released AGESA mitigations AMD released for Ryzen 5000 and above will only prevent infection -- they won't mean anything if the motherboard UEFI is already infected.

If my understanding is correct, I won't be buying any more used AMD motherboards....

 

[Markfw]

The way I read it is that the CPU is used to, via SMM, access a sensitive persistent memory area of the the motherboard UEFI BIOS at a specific point during the boot process, explaining why physical access is needed. That CPU access is then used to inject malicious software via SMM into the UEFI in an area that is persistent and which can't be scanned or accessed at any other time.

So, it would seem to me that once this is done, the motherboard itself is infected with malware in a persistent memory area of the UEFI.

This is my take, anyway.

Further, the released AGESA mitigations AMD released for Ryzen 5000 and above will only prevent infection -- they won't mean anything if the motherboard UEFI is already infected.

If my understanding is correct, I won't be buying any more used AMD motherboards....

In that case would not a bios refresh not that out ??? I mean ease the malware ????

 

[Steltek]

In that case would not a bios refresh not that out ??? I mean ease the malware ????

Because I believe that a UEFI BIOS update would not be able to write to the affected section of the UEFI. That section of the UEFI is normally locked down read only by the CPU -- it is only writeable at that specific instant of the boot cycle via SMM.

UEFI is gonna end up being the death of us all as none of the vendors seem to be willing to put the effort forward to truly secure it.

 

[JustViewing]

Because I believe that a UEFI BIOS update would not be able to write to the affected section of the UEFI. That section of the UEFI is normally locked down read only by the CPU -- it is only writeable at that specific instant of the boot cycle via SMM.

UEFI is gonna end up being the death of us all as none of the vendors seem to be willing to put the effort forward to truly secure it.

So how does an attacker going to write in that location?

 

[moinmoin]

So how does an attacker going to write in that location?

That's the exploit.

 

[JustViewing]

That's the exploit.

Exactly, same technique can be used for cleaning as well.

 

[moinmoin]

Exactly, same technique can be used for cleaning as well.

Well, let's hope that for normies there will be a non-malware tool to check for it and remove malware if AMD doesn't do it.

 

[VirtualLarry]

Hmm. I kinda agree, but I'm sure their suits have a reason, even if that reason kinda sucks. Like "this CPU is out of warranty". Or whatever. Would it really cost them that much to plug the hole on AM4 across the board? I should think not!