News: 0001587733

  ARM Give a man a fire and he's warm for a day, but set fire to him and he's warm for the rest of his life (Terry Pratchett, Jingo)

AMD Updates Zen 3 / Zen 4 CPU Microcode For Systems Lacking Microcode Signing Fix

([AMD] 49 Minutes Ago AMD Zen 3 / Zen 4 Microcode)


AMD this week uploaded new Family 19h CPU microcode for Zen 3 and Zen 4 processors to the linux-firmware.git repoository that in turn is pulled by the Linux distributions for offering the latest firmware/microcode to users.

AMD CPU microcode updates to linux-firmware.git typically come without any change-log or details as to the changes, but this time is different. Thanks to a README update we have a bit more context around this new Zen 3 / Zen 4 microcode update.

Earlier this year AMD announced a CPU microcode signature verification vulnerability that was discovered by Google. An attacker with system admin privileges could load malicious CPU microcode patches that didn't need to be signed by AMD. In turn the malicious CPU microcode patches could lead to loss of integrity for x86 instruction execution, loss of confidentiality and integrity of data, or compromising the SMM execution environment. [1]This security bulletin goes into all the details but long story short the signature verification of the AMD CPU ROM microcode patch loader was inadequate.

AMD released updated BIOS/microcode to deal with this issue. But not all motherboard/system vendors shipped updated BIOS to their customers. What the new AMD Family 19h CPU microcode for Linux users is for this week is now having a second patch to bring the microcode to the highest possible level without the microcode signing fix. As some reprieve for those lacking an updated BIOS but wanting to run as much of an updated CPU microcode at run-time as possible.

The README update with the new [2]microcode commit explains:

"NOTE: In order to not fully abandon machines affected by AMD-SB-7033 that have not received the BIOS update, the family 19h microcode container now includes a second patch for these machines that brings the microcode to the highest possible level without the microcode signing fix. While a BIOS update is highly recommended to receive the latest security updates issued after the microcode signing vulnerability, this will allow non-updated systems to at least receive some microcode updates beyond the version provided by BIOS."

So a nice effort by AMD for those on prior-generation Zen 3 / Zen 4 products on Linux.



[1] https://www.amd.com/en/resources/product-security/bulletin/amd-sb-7033.html

[2] https://git.kernel.org/pub/scm/linux/kernel/git/firmware/linux-firmware.git/commit/?id=ad91544767665e911386e62ecebaa969e2cfb1c0


"We invented a new protocol and called it Kermit, after Kermit the Frog,
star of "The Muppet Show." [3]

[3] Why? Mostly because there was a Muppets calendar on the wall when we
were trying to think of a name, and Kermit is a pleasant, unassuming sort of
character. But since we weren't sure whether it was OK to name our protocol
after this popular television and movie star, we pretended that KERMIT was an
acronym; unfortunately, we could never find a good set of words to go with the
letters, as readers of some of our early source code can attest. Later, while
looking through a name book for his forthcoming baby, Bill Catchings noticed
that "Kermit" was a Celtic word for "free", which is what all Kermit programs
should be, and words to this effect replaced the strained acronyms in our
source code (Bill's baby turned out to be a girl, so he had to name her Becky
instead). When BYTE Magazine was preparing our 1984 Kermit article for
publication, they suggested we contact Henson Associates Inc. for permission
to say that we did indeed name the protocol after Kermit the Frog. Permission
was kindly granted, and now the real story can be told. I resisted the
temptation, however, to call the present work "Kermit the Book."
-- Frank da Cruz, "Kermit - A File Transfer Protocol"