Chipmaker AMD released a critical security update addressing a high-severity vulnerability affecting its Zen 1 to Zen 4 processors. The flaw is designated CVE-2024-56161 and could potentially compromise the Secure Encrypted Virtualisation (SEV) feature, which safeguards virtual machines (VMs) and AMD EPYC processors.
The vulnerability, which was disclosed by Google researchers Josh Eads, Kristoffer Janke, Eduardo ‘Vela’ Nava, Tavis Ormandy and Matteo Rizzo, stems from an improper signature verification flaw in the CPU ROM microcode patch loader. If exploited, attackers with local administrative privileges could inject malicious microcode, undermining the integrity and confidentiality of SEV-SNP-protected VMs.
SEV, a hardware-based security feature, encrypts VM memory with unique encryption keys, preventing unauthorised access from hypervisors or other VMs.
“Researchers from Google have provided AMD with information on a potential vulnerability that, if successfully exploited, could lead to the loss of SEV-based protection of a confidential guest,” AMD wrote.
AMD has assigned a severity score of 7.2/10 (high) to this vulnerability, underlining its potential impact on affected systems.
AMD has released a microcode update applicable to all impacted platforms to mitigate the risk. Additionally, certain platforms require a SEV firmware update to ensure proper SEV-SNP attestation.
“AMD has made available a mitigation for this issue, which requires updating the microcode on all impacted platforms to help prevent an attacker from loading malicious microcode. Additionally, a SEV firmware update is required for some platforms to support SEV-SNP attestation,” AMD explained.
Users must update their system BIOS and reboot their platforms and their activities as mitigation measures. The effectiveness of the patch can be verified through the SEV-SNP attestation report.
“Updating the system BIOS image and rebooting the platform will enable attestation of the mitigation. A confidential guest can verify the mitigation has been enabled on the target platform through the SEV-SNP attestation report,” AMD concluded.
In the News: DOGE agency stops using Slack to shield records from FOIA
