That’s so stupid, also because they have fixes for Zen and Zen 2 based Epyc CPUs available.
Intel vs. AMD isn’t “bad guys” vs. “good guys”. Either company will take every opportunity to screw their customers over. Sure, “don’t buy Intel” holds true for 13th and 14th gen Core CPUs specifically, but other than that it’s more of a pick your poison.
That’s still far away from us as a consumer standpoint, but I’m eagerly waiting for a time when I could buy a RISC V laptop with atleast midrange computing capabalities
I‘m more on the builder/tinkerer side so I‘m pretty much in starting position with risc-v now. But yes, its going to be some time before any of it is user ready as a pc.
Indeed I am. I‘m in posession of a working laptop but I could maybe order a riscv tablet from pine64. I already have the pinetime and the stuff is pretty awesome.
I’m waiting to see how DeepComputing’s RISC-V mainboard for the Framework turns out. I’m aware that this is very much a development platform and far from an actual end-user product, but if the price is right, I might jump in to experiment.
This is one of the hardest earned lessons I’ve ever learned, and I’ve had to learn it over and over again. I think it’s mostly stuck now but I still make the same mistake from time to time.
I’m not buying hardware that doesn’t suit my needs as an investment hoping maybe it eventually will.
You were misrepresenting things. Your needs have nothing to do with things not being functional. Something can be perfectly functional and not meet someones needs. Nobody said you should buy it as an investment.
My interpretation was by far the most generous to your position, because it’s the only way it’s coherent.
If people bought [this hardware that doesn’t actually provide anything anyone can realistically use at a reasonable price] it might eventually not suck. That’s treating a current purchase as an imaginary investment in maybe eventually being able to buy something useful.
My interpretation was by far the most generous to your position, because it’s the only way it’s coherent.
You’re entitled to your opinion, I guess.
hardware that doesn’t actually provide anything anyone can realistically use
Thats misrepresenting reality and making assumptions while clearly showing lack of expertise
at a reasonable price
Thats completely arbitrary. If a price is reasonable or not depends on many factors. Obvious oversymplification.
That’s treating a current purchase as an imaginary investment in maybe eventually being able to buy something useful.
This shows that you have no idea what you are talking about. Small companies and open source projects depend on people buying their products instead of cheaper, sometimes better performing products of big conglomerates for other reasons than price alone.
They are 100% not patching old chips intentionally by not allocating resources to it. It’s a conscious choice made by the company, it is very much “on purpose”.
That’s not what I was referring to. I was referring to the act of “adding vulnerabilities”. Surely they aren’t doing that on purpose. And surely they would add fixes for it if it was economically viable? It’s a matter of goodwill and reputation, right?
I don’t know, I just don’t think it’s AMD’s business model to “screw over” their customers. I just don’t.
The cost isn’t that high. They’re already doing it for a bunch of parallel systems.
In a just world they’d be legally required to provide the fixes, or fully refund the entire platform cost. It’s not remotely ethical to allow this to exist unpatched anywhere, regardless of support life.
What I mean by that is that they will take a huge disservice to their customers over a slight financial inconvenience (packaging and validating an existing fix for different CPU series with the same architecture).
I don’t classify fixing critical vulnerabilities from products as recent as the last decade as “goodwill”, that’s just what I’d expect to receive as a customer: a working product with no known vulnerabilities left open. I could’ve bought a Ryzen 3000 CPU (maybe as part of cheap office PCs or whatever) a few days ago, only to now know they have this severe vulnerability with the label WONTFIX on it. And even if I bought it 5 years ago: a fix exists, port it over!
I know some people say it’s not that critical of a bug because an attacker needs kernel access, but it’s a convenient part of a vulnerability chain for an attacker that once exploited is almost impossible to detect and remove.
Maybe they’ll reverse course with enough blowback, they did that once with ryzen already, don’t remember which Gen it was but it wasn’t going to be backwards compatible with certain type of mobos, but then they released it anyway and some mobo manufacturers did provide bios updates to support it.
Similarish situation could happen here, the biggest hangup I’d think is that the 3000 series is nearly 5 years old, and getting mobo manufacturers on board for that could be difficult.
No they are just choosing not to roll out the fix to a known issue, which is screwing customers over on purpose (to increase profits). It’s not a matter of goodwill, they sold a product that then turned out to have a massive security flaw, and now they don’t want to fix even though they absolutely could.
Ryzen 3000 series CPUs are still sold as new, I even bought one six months ago, they’re no where near being classified as “old”, they’re hardly 5 years old. And this is not only an issue for already infected systems because uninfected systems will intentionally be left vulnerable.
No, but those vulnerabilities where there when you bought it.
Would a car have a defect that was shown 5 years later, then the manufacturer would have to recall it or offer a repair program and or money in exchange.
Since everything is proprietary you cannot even fix things like this by yourself. The manufacturer needs to be held liable.
Would a car have a defect that was shown 5 years later, then the manufacturer would have to recall it or offer a repair program and or money in exchange.
I mean… A car is different, depending on the defect. It’s like “this window only breaks if you’ve already crashed the car”. (The defect only causes a vulnerability if the system is already compromised AFAICT.) And 5 years is much, much younger for a car compared to a CPU, but that’s not the important bit, I know.
But I agree with you all, I am not saying it shouldn’t be fixed, I was just saying I don’t think AMD is looking to screw over their customers on purpose. That’s all.
“this window only breaks if you’ve already crashed the car”
No, it’s usually more like “this thing will break and cause a car crash” or “this thing will murder everyone in the vehicle if you crash”. And companies still will not fix it. Look at the Ford Pinto, executives very literally wrote off people’s deaths as a cost of doing business, when they’d turn into fireballs during even low speed rear-end collisions. Potentially burning down the car that hit them too.
Edit: I mean, just look at the Takata airbag recall. 100 million airbags from 20 different carmakers recalled because they wouldn’t activate during a crash.
When I said “It’s like”, I meant it as a simile to what’s going on with AMD right now. Not with what’s actually going on with car companies. Car companies are a whole different topic and discussion, of which I know nothing.
If they get root or admin they can hack the chip itself.
But minor exploits, nada, no issue, you good. Gotta get root to make it happen.
Problem is if you, as they say, get got, you have no way of knowing if they’re in your CPU, and no way to fix if they did – basically gotta trash it and replace.
They aren’t patching CPUs that were released 5 years ago.
They should be patching back to Ryzen 1 since those are still perfectly good CPUs. 5-7 years really isn’t that old considering how little improvement there is with each generation.
Sure, not much per gen, but if you compare say a 1700x vs the current 9700x, you are roughly looking at a 3x improvement in single and multicore performance increase.
Most of desktop users don’t care at all about these gains. Slap in normal ram and an SSD and a 1000 series Ryzen is ready to be a run of the mill desktop, that browses and can show media no problem.
My threadripper 1950x is from 2017… and is the cpu powering my primary hypervisor perfectly fine. That’s not 18 years ago, that’s not even 8 years ago.
Really not good enough from AMD. I wonder if Intel wasn’t a complete dumpster fire right now if they would still cut off the fix at Zen 3 (I doubt it). There’s really no reason not to issue a fix for these other than they don’t want to pay the engineers for the time to do it, and they think it won’t cost them any reputational damage.
I hate that every product and company sucks so hard these days.
That’s why they don’t mind the reputation hit. If 1 person swears allegiance to Intel as a result but 2 people buy new AMD chips, they’re still ahead. And people will forget eventually. But AMD won’t forget the Q3 2024 sales figures.
They are doing similar stuff with deliberately delaying Linux driver capabilities for Radeon 7xxx series, to make more GPUs die out faster, by overheating (zero RPM fan until 60°+).
Basically, reflash spi chips and it’ll be gone, and to be infected by that, person gotta have physical access to hardware he hacks, and physical access is root access as always has been
Attackers need to access the system kernel to exploit the Sinkclose vulnerability, so the system would have to already be compromised. The hack itself is a sophisticated vector that is usually only used by state-sponsored hackers, so most casual users should take that into account.
So it’s a vulnerability that requires you to.already have been compromised. Hardly seems like news.
I can understand AMD only patching server chips that by definition will be under greater threat. On the other hand it’s probably not worth the bad publicity not to fix more.
I personally agree. I think it’s being somewhat overhyped. If step one is physical access to get things rolling… like for sure some machines are in more public areas than others. But for me, someone would have to break into my house first, then access my machine, just to run exploits later. The exploit is pretty massive, but I think needs to be tempered with “first they need physical access”. Because physically controlling machines has always been number 1 for security.
It’s important because it allows them to directly modify the CPU’s microcode. Basically, the CPU has its own set of instructions, called microcode, which controls how the chip functions on a physical level. If they manage to change your microcode, even a full system reformat won’t kill the virus; You’ll need to either re-flash the CPU (which is not something the standard user or even power user will know how to do) or replace the entire CPU.
The reason that this is news is because it allows malware to embed itself into the processor microcode once kernel is breached. IE: If it is exploited for compromise, you either have to have the knowledge and hardware to reset the processor microcode manually (Requires an SPI flash tool) or you toss the hardware entirely. There’s no just ‘blow the drive away and reinstall the OS’ solution available.
And that introduces a specific type of supply chain threat: someone who possesses a computer can infect their own computer, sell it or transfer it to the target, and then use the embedded microcode against the target, even if the target completely reformats and reinstalls a new OS from scratch.
That’s not going to affect most people, but for certain types of high value targets they now need to make sure that the hardware they buy hasn’t already been infected in the supply chain.
This sounds weird. I was in the impression that operating systems load updated cpu microcode at every boot, because it does not survive a power cycle, and because the one embedded in the BIOS/UEFI firmware is very often outdated. But then how exactly can a virus persist itself for practically forever?
The OS can’t get to the point of loading cpu microcode without that outdated, embedded microcode. The reason it can persist is because there aren’t a lot of good ways to see what that UEFI microcode actually is once it’s installed. Plus, only the UEFI tells you that it has successfully updated itself. There is no other more authoritative system to verify that against. So the virus could just lie and say it’s gone and you would never know. Hence needing to treat it as the worst case scenario, that it never leaves.
The good news is that in order to exploit the new vulnerability, the attacker first has to obtain kernel level access to the system somehow - by exploiting some other vulnerabilities perhaps.
The bad news is once Sinkclose attack is performed, it can be hard to detect and mitigate: it can even survive an OS reinstall.
The other bad news: there are so many vulnerabilities on all systems which can be used to gain root-level access, it’s just a matter of time. Also, even future vulnerabilities will be an issue, as the underlying Sinkclose attacks will still work.
So basically what you are saying is we just need one pvp game with kernel level anti cheat to fuck up somewhere… yeah I’m sure that’s not going to happen.
Probably only on a targeted attack. I don’t see it being a mass target attack like a worm could be.
And in the realm of businesses, how many programs are running in kernel level besides the antivirus/ED(P)R solution?
I don’t see it being a mass target attack like a worm could be.
Why not? Malware that survives a full new install is extremely valuable, and there are loads of games adding vulnerabilities with required kernel level rootkits. It’s only a matter of time until one of these vendors is exploited, and why wouldn’t you permanently own the significant chunk of the market with unpatched serious vulnerabilities while you’re at it?
Again: Mass spread vs target attack.
Remember WannaCry? Yeah, I don’t see that happen.
But (industrial) e-spionage on the other hand? Yup. Will happen 100%
Kernel level game anticheats are a great attack vector, and it’s one that inherently identifies and enables distribution to other vulnerable targets. It’s begging to self replicate.
Industrial espionage does not make sense, because most enterprises have, even if imperfect, restrictions on what can be installed on company computers that contain valuable information. You’re not going to get a game with kernel malware on a managed enterprise computer.
Are you ignoring what I wrote earlier in the same thread?
Probably only on a targeted attack. I don’t see it being a mass target attack like a worm could be.
And in the realm of businesses, how many programs are running in kernel level besides the antivirus/ED(P)R solution?
Anyway. Counter question: Why do you think gamers appear as a more valuable target with the anti cheat as a possible attack vector vs a business running literally the same CPU line-up but with fewer kernel level programs?
My personal opinion: You can’t extract as much money from private folks vs a business through blackmail and other solutions. Not in a wide casted attack.
Targeted individuals can be assumed to be at a higher risk (e.g. hacking their private devices like the gaming pc and then doing home office work in the same network, or misusing trust in the home network between pc and phone and then installing malware like pegasus).
But again: Not in a wide casted net. And you are probably better of using the good exploits for higher value targets.
we just need one pvp game with kernel level anti cheat
Leaving aside that security patches should be done, if you install that kind of game on a system where you have any data worth protecting, you’re a dumb ass mtherfcker. Sorry, but seriously, that’s just how it is.
Despite this being reported on tech news, most people won’t even be aware that it’s a thing because most people won’t actually read about it. And the majority of gamers probably don’t even know what a kernel is or why an anti-cheat with elevated privileges would be a bad thing.
Most people buy their computers with Windows preinstalled and probably couldn’t tell you if the CPU is Intel or AMD.
Okay, fair point, let me rephrase: if someone knows what kernel (admin) level execution means, and installs a game that requires this on a computer where they keep important data, they are a dumbass mtherfcker :)
Generally speaking though: most people shouldn’t be allowed to use technology - humans are unbelievably stupid for the most part.
Kernel level and admin level is not the same thing. For example on windows, you can’t really write your own kernel driver, and on Linux even root can’t do everything if capabilities have been revoked.
For the purpose of protecting important data, the distinction really doesn’t matter. And the good old xkcd comic has a point - for many people, all relevant data is in the user’s accessible storage area anyways. Hence me running almost all internet applications and steam in a jail.
How do you trust that the flash was done properly if you did it from the compromised system? This would only work if you flashed it externally somehow without the system running.
Yeah, I have been eyeing upgrades to get avx512 anyway because lately I have been doing very heave very low preset av1 encodes but when they are a dick about it I just feel like postponing it.
I feel like this is the perfect place for Right to Repair legislation: the product is broken? And it’s outside your support window? Then give customers what they need to make the fix themselves. It’s not good enough to say “meh, guess you gotta buy one of our newer chips then 🤷”
AMD has unfortunately a long history of abandoning products before its reasonable on its graphics division. Its not really acceptable, up until earlier this year my NAS/server was running a 3600 and its only for power saving purposes I changed that as its still a very workable CPU in that role.
Er I’m still running a FX-8350 as a gaming machine (not AAA games obviously). I had another one as a host for a few VMs and it was more than enough till the motherboard went. One day I’ll upgrade I guess.
I moved from an FX8350 to a R5 5600G a few years ago, having run it for about 9 years. Initially I didn’t think I’d notice much difference, but frankly it’s an entirely different ballgame.
You are not logged in. However you can subscribe from another Fediverse account, for example Lemmy or Mastodon. To do this, paste the following into the search field of your instance: !selfhosted@lemmy.world
A place to share alternatives to popular online services that can be self-hosted without giving up privacy or locking you into a service you don’t control.
Rules:
Be civil: we’re here to support and learn from one another. Insults won’t be tolerated. Flame wars are frowned upon.
No spam posting.
Posts have to be centered around self-hosting. There are other communities for discussing hardware or home computing. If it’s not obvious why your post topic revolves around selfhosting, please include details to make it clear.
Don’t duplicate the full text of your blog or github here. Just post the link for folks to click.
Submission headline should match the article title (don’t cherry-pick information from the title to fit your agenda).
That’s so stupid, also because they have fixes for Zen and Zen 2 based Epyc CPUs available.
Intel vs. AMD isn’t “bad guys” vs. “good guys”. Either company will take every opportunity to screw their customers over. Sure, “don’t buy Intel” holds true for 13th and 14th gen Core CPUs specifically, but other than that it’s more of a pick your poison.
Tangent: If we started buying risc-v systems we might get to a point where they can actually compete.
That’s still far away from us as a consumer standpoint, but I’m eagerly waiting for a time when I could buy a RISC V laptop with atleast midrange computing capabalities
I‘m more on the builder/tinkerer side so I‘m pretty much in starting position with risc-v now. But yes, its going to be some time before any of it is user ready as a pc.
Framework has a laptop in progress if you’re interested
Indeed I am. I‘m in posession of a working laptop but I could maybe order a riscv tablet from pine64. I already have the pinetime and the stuff is pretty awesome.
Well the Star64 from Pine is pretty good, just doesn’t have enough processing power and IO for my liking.
It is crazy efficient
I’m waiting to see how DeepComputing’s RISC-V mainboard for the Framework turns out. I’m aware that this is very much a development platform and far from an actual end-user product, but if the price is right, I might jump in to experiment.
Sounds like a cool idea! :)
Jeff Geerling had a video recently about the state of RISC V for desktop. https://youtu.be/YxtFctEsHy0?si=SUQBiepSeOne8-2u
I really enjoyed watching it. Thanks for referring to it.
At the rate we are going Qualcomm might pivot to Risc-V (they are being sued by ARM)
Interesting! Thanks for chiming in. I‘ll read up about it.
I’m not buying hardware that doesn’t suit my needs as an investment hoping maybe it eventually will.
This is one of the hardest earned lessons I’ve ever learned, and I’ve had to learn it over and over again. I think it’s mostly stuck now but I still make the same mistake from time to time.
Yeah, thats the reason why we‘re in this capitalist hellhole. Perfection comes from billionaire money, nothing else.
What are you talking about perfection?
Buying something that doesn’t function is never rational.
You were misrepresenting things. Your needs have nothing to do with things not being functional. Something can be perfectly functional and not meet someones needs. Nobody said you should buy it as an investment.
My interpretation was by far the most generous to your position, because it’s the only way it’s coherent.
If people bought [this hardware that doesn’t actually provide anything anyone can realistically use at a reasonable price] it might eventually not suck. That’s treating a current purchase as an imaginary investment in maybe eventually being able to buy something useful.
You’re entitled to your opinion, I guess.
Thats misrepresenting reality and making assumptions while clearly showing lack of expertise
Thats completely arbitrary. If a price is reasonable or not depends on many factors. Obvious oversymplification.
This shows that you have no idea what you are talking about. Small companies and open source projects depend on people buying their products instead of cheaper, sometimes better performing products of big conglomerates for other reasons than price alone.
“Both sides”
“Vote third party!”
Wtf seriously this isn’t the same thing remotely but the arguments used are.
cmon man
How is AMD “screwing us over”? Surely they aren’t doing this on purpose? That seems very cynical.
They are 100% not patching old chips intentionally by not allocating resources to it. It’s a conscious choice made by the company, it is very much “on purpose”.
That’s not what I was referring to. I was referring to the act of “adding vulnerabilities”. Surely they aren’t doing that on purpose. And surely they would add fixes for it if it was economically viable? It’s a matter of goodwill and reputation, right?
I don’t know, I just don’t think it’s AMD’s business model to “screw over” their customers. I just don’t.
The cost isn’t that high. They’re already doing it for a bunch of parallel systems.
In a just world they’d be legally required to provide the fixes, or fully refund the entire platform cost. It’s not remotely ethical to allow this to exist unpatched anywhere, regardless of support life.
I agree. 👌
What I mean by that is that they will take a huge disservice to their customers over a slight financial inconvenience (packaging and validating an existing fix for different CPU series with the same architecture).
I don’t classify fixing critical vulnerabilities from products as recent as the last decade as “goodwill”, that’s just what I’d expect to receive as a customer: a working product with no known vulnerabilities left open. I could’ve bought a Ryzen 3000 CPU (maybe as part of cheap office PCs or whatever) a few days ago, only to now know they have this severe vulnerability with the label WONTFIX on it. And even if I bought it 5 years ago: a fix exists, port it over!
I know some people say it’s not that critical of a bug because an attacker needs kernel access, but it’s a convenient part of a vulnerability chain for an attacker that once exploited is almost impossible to detect and remove.
Well, you feel how you feel, and you choose the products you want after this. Good luck to you! 👍
Edit: So many down votes for wishing someone good luck. The hive mind is odd sometimes.
Maybe they’ll reverse course with enough blowback, they did that once with ryzen already, don’t remember which Gen it was but it wasn’t going to be backwards compatible with certain type of mobos, but then they released it anyway and some mobo manufacturers did provide bios updates to support it.
Similarish situation could happen here, the biggest hangup I’d think is that the 3000 series is nearly 5 years old, and getting mobo manufacturers on board for that could be difficult.
No they are just choosing not to roll out the fix to a known issue, which is screwing customers over on purpose (to increase profits). It’s not a matter of goodwill, they sold a product that then turned out to have a massive security flaw, and now they don’t want to fix even though they absolutely could.
I’m guessing it’s a balance between old products, effort, severity, etc. As we’ve learned, this is only an issue for an already infected system. 🤷♂️
Ryzen 3000 series CPUs are still sold as new, I even bought one six months ago, they’re no where near being classified as “old”, they’re hardly 5 years old. And this is not only an issue for already infected systems because uninfected systems will intentionally be left vulnerable.
Ah, that changes things. Not great. But still,
what I meant was that apparently only compromised systems are vulnerable to this defect.
Just because a store is still selling their stock doesn’t mean AND is still making them and selling them.
No, but those vulnerabilities where there when you bought it.
Would a car have a defect that was shown 5 years later, then the manufacturer would have to recall it or offer a repair program and or money in exchange.
Since everything is proprietary you cannot even fix things like this by yourself. The manufacturer needs to be held liable.
I mean… A car is different, depending on the defect. It’s like “this window only breaks if you’ve already crashed the car”. (The defect only causes a vulnerability if the system is already compromised AFAICT.) And 5 years is much, much younger for a car compared to a CPU, but that’s not the important bit, I know.
But I agree with you all, I am not saying it shouldn’t be fixed, I was just saying I don’t think AMD is looking to screw over their customers on purpose. That’s all.
No, it’s usually more like “this thing will break and cause a car crash” or “this thing will murder everyone in the vehicle if you crash”. And companies still will not fix it. Look at the Ford Pinto, executives very literally wrote off people’s deaths as a cost of doing business, when they’d turn into fireballs during even low speed rear-end collisions. Potentially burning down the car that hit them too.
Edit: I mean, just look at the Takata airbag recall. 100 million airbags from 20 different carmakers recalled because they wouldn’t activate during a crash.
When I said “It’s like”, I meant it as a simile to what’s going on with AMD right now. Not with what’s actually going on with car companies. Car companies are a whole different topic and discussion, of which I know nothing.
So I have a 3700x, I’ve read about the vulnerability but don’t fully understand it. How at risk am I?
If an attacker gets access to your system, they will be able to ensure you can’t get rid of their access
It will persist across operating system installs
However, this requires them to get access first
Sounds like it’s time for an upgrade. Never know what kind of weirdos are out there. Thanks for the information.
In short, if you’re pwned once, you are pwn3d f0r3v#rrrrreeeheehaahaahaa*cough**cough*
These are the kinds of exploits you use to create APT (Advanced Persistent Threats).
If they get root or admin they can hack the chip itself.
But minor exploits, nada, no issue, you good. Gotta get root to make it happen.
Problem is if you, as they say, get got, you have no way of knowing if they’re in your CPU, and no way to fix if they did – basically gotta trash it and replace.
Yes.
Not particularly. The exploit requires ring 0 access, if an attacker managed to get that, you are screwed already.
Acronyms, initialisms, abbreviations, contractions, and other phrases which expand to something larger, that I’ve seen in this thread:
3 acronyms in this thread; the most compressed thread commented on today has 4 acronyms.
[Thread #919 for this sub, first seen 12th Aug 2024, 20:35] [FAQ] [Full list] [Contact] [Source code]
AMD published a list with the mitigation on Sinkclose on all their processor ranges, and the ComboPI version that will have a patch:
Security bulletin 7014
deleted by creator
deleted by creator
They aren’t patching CPUs that were released 5 years ago.
They should be patching back to Ryzen 1 since those are still perfectly good CPUs. 5-7 years really isn’t that old considering how little improvement there is with each generation.
Sure, not much per gen, but if you compare say a 1700x vs the current 9700x, you are roughly looking at a 3x improvement in single and multicore performance increase.
Most of desktop users don’t care at all about these gains. Slap in normal ram and an SSD and a 1000 series Ryzen is ready to be a run of the mill desktop, that browses and can show media no problem.
I care! But I’m a power user. Most aren’t.
I suppose that is true. Intel seems to think so as well as their low power n100 is about the performance of a 1500x.
Some people really don’t think before they speak do they
Ryzen 2000 and 3000 are still fairly recent and were announced 5-6 years ago.
deleted by creator
3600 was released in 2019. And it they was making it for at least 2 years.
The Ryzen 5 3600 is from 2019. The XT refreshes so Ryzen 5 3600xt from mid 2020
What are you on about?
Ryzen 3xxx series processors are still being sold new today
The oldest zen processors are only just over half a decade old—a consumer CPU should be expected to be in service at least double that time.
Support should be 5 years after End of Life or end of Manufacturing date.
AMD is producing them new or your local shop us? Because AMD doesnt care about your local tech shop dead stock.
Maybe they should, and also care about the many people still using these processors that are not very old.
My threadripper 1950x is from 2017… and is the cpu powering my primary hypervisor perfectly fine. That’s not 18 years ago, that’s not even 8 years ago.
@just_another_person @TheHolm where do you get the 15 year old hardware from?
Really not good enough from AMD. I wonder if Intel wasn’t a complete dumpster fire right now if they would still cut off the fix at Zen 3 (I doubt it). There’s really no reason not to issue a fix for these other than they don’t want to pay the engineers for the time to do it, and they think it won’t cost them any reputational damage.
I hate that every product and company sucks so hard these days.
They did issue a fix: “Buy a new CPU please!”
That’s why they don’t mind the reputation hit. If 1 person swears allegiance to Intel as a result but 2 people buy new AMD chips, they’re still ahead. And people will forget eventually. But AMD won’t forget the Q3 2024 sales figures.
Well, guess who’s not buying next gen Ryzen?
They are doing similar stuff with deliberately delaying Linux driver capabilities for Radeon 7xxx series, to make more GPUs die out faster, by overheating (zero RPM fan until 60°+).
deleted by creator
Basically, reflash spi chips and it’ll be gone, and to be infected by that, person gotta have physical access to hardware he hacks, and physical access is root access as always has been
Nope. You do not need physical access for it, just root access. and you HW is compromised with only means to recover it is SPI flashing of CPU.
So it’s a vulnerability that requires you to.already have been compromised. Hardly seems like news.
I can understand AMD only patching server chips that by definition will be under greater threat. On the other hand it’s probably not worth the bad publicity not to fix more.
I personally agree. I think it’s being somewhat overhyped. If step one is physical access to get things rolling… like for sure some machines are in more public areas than others. But for me, someone would have to break into my house first, then access my machine, just to run exploits later. The exploit is pretty massive, but I think needs to be tempered with “first they need physical access”. Because physically controlling machines has always been number 1 for security.
It’s important because it allows them to directly modify the CPU’s microcode. Basically, the CPU has its own set of instructions, called microcode, which controls how the chip functions on a physical level. If they manage to change your microcode, even a full system reformat won’t kill the virus; You’ll need to either re-flash the CPU (which is not something the standard user or even power user will know how to do) or replace the entire CPU.
The reason that this is news is because it allows malware to embed itself into the processor microcode once kernel is breached. IE: If it is exploited for compromise, you either have to have the knowledge and hardware to reset the processor microcode manually (Requires an SPI flash tool) or you toss the hardware entirely. There’s no just ‘blow the drive away and reinstall the OS’ solution available.
And that introduces a specific type of supply chain threat: someone who possesses a computer can infect their own computer, sell it or transfer it to the target, and then use the embedded microcode against the target, even if the target completely reformats and reinstalls a new OS from scratch.
That’s not going to affect most people, but for certain types of high value targets they now need to make sure that the hardware they buy hasn’t already been infected in the supply chain.
I don’t think it gets to the microcode but the UEFI.
This sounds weird. I was in the impression that operating systems load updated cpu microcode at every boot, because it does not survive a power cycle, and because the one embedded in the BIOS/UEFI firmware is very often outdated. But then how exactly can a virus persist itself for practically forever?
The OS can’t get to the point of loading cpu microcode without that outdated, embedded microcode. The reason it can persist is because there aren’t a lot of good ways to see what that UEFI microcode actually is once it’s installed. Plus, only the UEFI tells you that it has successfully updated itself. There is no other more authoritative system to verify that against. So the virus could just lie and say it’s gone and you would never know. Hence needing to treat it as the worst case scenario, that it never leaves.
That being said it builds up vulnerabilities in anti-cheats to another beautiful crowstrike like domino cluster fuck
How severe is this vulnerability?
The good news is that in order to exploit the new vulnerability, the attacker first has to obtain kernel level access to the system somehow - by exploiting some other vulnerabilities perhaps.
The bad news is once Sinkclose attack is performed, it can be hard to detect and mitigate: it can even survive an OS reinstall.
The other bad news: there are so many vulnerabilities on all systems which can be used to gain root-level access, it’s just a matter of time. Also, even future vulnerabilities will be an issue, as the underlying Sinkclose attacks will still work.
Honestly not on a hardened setup
Sure, if you’d rather like to believe that.
If it was that easy to get root then we would be in serious trouble. The best way I can think of is social engineering.
So basically what you are saying is we just need one pvp game with kernel level anti cheat to fuck up somewhere… yeah I’m sure that’s not going to happen.
Probably only on a targeted attack. I don’t see it being a mass target attack like a worm could be.
And in the realm of businesses, how many programs are running in kernel level besides the antivirus/ED(P)R solution?
The USB and network stack
Why not? Malware that survives a full new install is extremely valuable, and there are loads of games adding vulnerabilities with required kernel level rootkits. It’s only a matter of time until one of these vendors is exploited, and why wouldn’t you permanently own the significant chunk of the market with unpatched serious vulnerabilities while you’re at it?
Again: Mass spread vs target attack.
Remember WannaCry? Yeah, I don’t see that happen.
But (industrial) e-spionage on the other hand? Yup. Will happen 100%
For what reason?
Kernel level game anticheats are a great attack vector, and it’s one that inherently identifies and enables distribution to other vulnerable targets. It’s begging to self replicate.
Industrial espionage does not make sense, because most enterprises have, even if imperfect, restrictions on what can be installed on company computers that contain valuable information. You’re not going to get a game with kernel malware on a managed enterprise computer.
Are you ignoring what I wrote earlier in the same thread?
Anyway. Counter question: Why do you think gamers appear as a more valuable target with the anti cheat as a possible attack vector vs a business running literally the same CPU line-up but with fewer kernel level programs?
My personal opinion: You can’t extract as much money from private folks vs a business through blackmail and other solutions. Not in a wide casted attack.
Targeted individuals can be assumed to be at a higher risk (e.g. hacking their private devices like the gaming pc and then doing home office work in the same network, or misusing trust in the home network between pc and phone and then installing malware like pegasus).
But again: Not in a wide casted net. And you are probably better of using the good exploits for higher value targets.
And with crowd strike we have seen how reliable Antivirus is.
Leaving aside that security patches should be done, if you install that kind of game on a system where you have any data worth protecting, you’re a dumb ass mtherfcker. Sorry, but seriously, that’s just how it is.
Ignorance is not stupidity.
Despite this being reported on tech news, most people won’t even be aware that it’s a thing because most people won’t actually read about it. And the majority of gamers probably don’t even know what a kernel is or why an anti-cheat with elevated privileges would be a bad thing.
Most people buy their computers with Windows preinstalled and probably couldn’t tell you if the CPU is Intel or AMD.
Okay, fair point, let me rephrase: if someone knows what kernel (admin) level execution means, and installs a game that requires this on a computer where they keep important data, they are a dumbass mtherfcker :) Generally speaking though: most people shouldn’t be allowed to use technology - humans are unbelievably stupid for the most part.
Kernel level and admin level is not the same thing. For example on windows, you can’t really write your own kernel driver, and on Linux even root can’t do everything if capabilities have been revoked.
For the purpose of protecting important data, the distinction really doesn’t matter. And the good old xkcd comic has a point - for many people, all relevant data is in the user’s accessible storage area anyways. Hence me running almost all internet applications and steam in a jail.
You need to be a root to exploit it, but if it get exploited any way to get rid of it is to throw MB to trash.
Patch/reflash with a new bios?
How do you trust that the flash was done properly if you did it from the compromised system? This would only work if you flashed it externally somehow without the system running.
deleted by creator
¯\_(ツ)_/¯
Exactly. That’s why it’s a trash motherboard as soon as root access is gained. It can never again be trusted.
A flash programmer
anyone know how intel’s microcode update policy is in comparison to AMD’s?
lol for the past 15 years I have “rebuilt” my desktop every 5 years but I didn’t expect the would try to force me out of my 7 3700x right on the date
Which is a shame because our 3700X is still pretty potent for the average user or gamer.
At launch, I’ve upgraded my system to a 3900x, and even today, it fulfills my cpu needs. This thing is incredible
Yea i got the 3900xt when i built my pc during covid. Love it but i had to disable a bunch of shit to prevent bluescreens from hypervisor shit
Yeah, I have been eyeing upgrades to get avx512 anyway because lately I have been doing very heave very low preset av1 encodes but when they are a dick about it I just feel like postponing it.
I feel like this is the perfect place for Right to Repair legislation: the product is broken? And it’s outside your support window? Then give customers what they need to make the fix themselves. It’s not good enough to say “meh, guess you gotta buy one of our newer chips then 🤷”
Especially since the Linux community are the types to go way overkill
Yep, every intel or AMD CPU vulnerability get patched in the kernel before the official firmware patches
removed by mod
removed by mod
you need a mental evaluation
removed by mod
Can you rub those 2 braincells together any faster might help some not enough probably
please seek help
removed by mod
AMD has unfortunately a long history of abandoning products before its reasonable on its graphics division. Its not really acceptable, up until earlier this year my NAS/server was running a 3600 and its only for power saving purposes I changed that as its still a very workable CPU in that role.
Er I’m still running a FX-8350 as a gaming machine (not AAA games obviously). I had another one as a host for a few VMs and it was more than enough till the motherboard went. One day I’ll upgrade I guess.
I moved from an FX8350 to a R5 5600G a few years ago, having run it for about 9 years. Initially I didn’t think I’d notice much difference, but frankly it’s an entirely different ballgame.
Oh yeah I plan to update. But only when I really get annoyed.
Single core performance is niiice