AMD processors can be unlocked with new safety failure – update your BIOS now!

Google researchers revealed a critical vulnerability in AMD processors based on architectures It was 1 a. Called “EntrySign“The failure allows any user with local administrative privileges to change the CPU microcode, modifying its operation.

Although AMD has launched a correction to the problem through a BIOS update, processors whose firmware has not been updated before December 17, 2024 remain vulnerable.

To mitigate risks, it is highly recommended for users and organizations to update their systems to the latest version of BIOS.

What is Entrysign vulnerability?

Microcode is a low -level instruction set that determines how the CPU processes calculations. Both AMD and Intel create custom instructions for their processors and provide microcode updates when safety failures are detected.

Entrysign failure allows personalized codes to be sent to Zen 1 to Zen 4 CPUS, changing its operation. This can allow access to processor internal bufffers, modifications in the safety of virtual machines and other profound changes.

Initially, AMD stressed the risk to EPYC processors used on servers, but it is now clear that vulnerability affects a much larger range of Ryzen chips.

How does microcode work in a CPU?

For those who are not familiar with the term, the microcode is a set of instruction that determines how a processor executes commands. In simple terms, It’s like an “internal software” of the chipwhich translates more complex commands into operations that hardware can understand.

Manufacturers, such as AMD and Intel, can update this microcode through patches to correct failures or optimize processor performance. Usually, these updates are digitally signed to prevent malicious codes from being applied.

However, Entrysign failure allows strikers to modify this microcode without verifying AMD security, opening possibilities for improper exploration.

Why is this vulnerability worrying?

The problem with Entrysign is that Anyone with administrative access to the system can modify the operation of the processedR without AMD being able to prevent. This means that an attacker can change internal CPU instructions to:

• Disable Safety Mechanisms
• Create flaws that can be exploited remotely
• Change how certain software works
• Modify the safety of virtual machines

The technical details of the vulnerability were published on Google’s blog, and the company has made a tool kit available that allows users to explore the jailbreak feature in their processors.

How was the failure discovered?

Google search revealed that AMD used the inadequate AES-CMAC function to validate microcode updates. The researchers were able to reverse the safety keys, allowing the insertion of codes not signed directly into the processor.

With this failure, any user with administrative access can modify the microcode of an AMD processor and completely change their behavior without any restriction of the manufacturer

Tavis Forest, Google Engineer

The technical details of vulnerability were published on Google’s blog, And the company has made a tool kit available that allows users to explore the jailbreak feature in their processors.

Affected processors

Zen architecture 1 (2017)

• Ryzen 1000 Series (Ryzen 3, 5, 7)
• Ryzen Threadripper 1000 Series
• EPYC 7001 Series

Zen+ Architecture (2018)

• Ryzen 2000 Series (Ryzen 3, 5, 7)
• Ryzen Threadripper 2000 Series
• EPYC 7002 Series

Zen Architecture 2 (2019)

• Ryzen 3000 Series (Ryzen 3, 5, 7, 9)
• Ryzen Threadripper 3000 Series
• Ryzen 4000 Series (APUs para notebooks e desktops)
• EPYC 7002 Series

Zen 3 (2020) Architecture

• Ryzen 5000 Series (Ryzen 5, 7, 9)
• Ryzen Threadripper 5000 Series
• EPYC 7003 Series

Zen 4 (2022-2023) Architecture)

• Ryzen 7000 Series (Ryzen 5, 7, 9)
• Ryzen 7000x3d (Modelos Com 3D V-Cache)
• Ryzen 8000 Series (APUs para notebooks e desktops)
• EPYC 9004 series (Genoa, Bergamo)

If your processor is part of one of these series and did not receive an update of BIOS after December 17, 2024it may still be vulnerable.

Also read:

RISKS AND RECOMMENDATIONS

With Entrysign now publicly documented, the use of ancient AMD CPUs without proper update can pose a risk. There is also concern with the second -hand hardware market, as processors Ryzen of the 7000 or previous series may have malicious modified microcodes before resale.

The main recommendation is Update the processor firmware immediately through the AMD official BIOS or the motherboard manufacturers. Also, avoiding the purchase of used CPUs without reliable origin is a prudent measure to minimize the risk of exploration of this failure.

Fonte: Bug Hunters (Blog do Google)