Get the latest tech news
Google Release Details of AMD Microcode Vulnerability
Last month, Google security researchers disclosed a high-severity vulnerability in AMD's CPU microcode signature verification system, affecting multiple AMD processors. Today, they have released the full chain details of the vulnerability dubbed "EntrySign," a significant vulnerability (CVE-2024-56161) affecting AMD's Zen-based CPUs that allowed the execution of unauthorized microcode.
Since hardware bugs can't be fixed without replacing physical components, manufacturers developed a mechanism for microcode updates to patch critical issues. The researchers discovered that AMD used the example key from NIST documentation (2b7e1516 28aed2a6 abf71588 09cf4f3c) across multiple CPU generations. To demonstrate the vulnerability, the team created "zentool," a suite of utilities that can examine, author, sign, and load custom microcode patches.
Or read this on r/technology
