News: 0001539787

  ARM Give a man a fire and he's warm for a day, but set fire to him and he's warm for the rest of his life (Terry Pratchett, Jingo)

Linux Tightening Up AMD Zen 5 CPU Microcode Check

([AMD] 3 Hours Ago Zen 5)


Google engineers earlier this year [1]detailed an AMD CPU microcode signature verification vulnerability. For local users with administration/root privileges, it could lead to loading malicious CPU microcode patches on the system. Initially AMD Zen 1 through Zen 4 were affected but the Google security engineers since discovered Zen 5 also could be impacted. BIOS updates are rolling out to address this signature verification issue while the Linux kernel is also being patched for microcode protections on Zen 5.

Google engineers dubbed this AMD CPU microcode signature verification issue as the [2]EntrySign vulnerability. While the Zen 1 through Zen 4 software updates have rolled out to ensure dubious actors can't apply malicious CPU microcode updates, Zen 5 was only publicly acknowledged this week and BIOS updates are now rolling out there.

As an additional protection in the event of no BIOS update yet, a Linux kernel patch was posted today to ensure no bad CPU microcode can be applied on Zen 5 processors -- extending protections in place for earlier Zen processors. This is for all Zen 5 cores, including both the EPYC and Ryzen product lines.

[3]The patch message explains:

"All Zen5 machines out there should get BIOS updates which update to the correct microcode patches addressing the microcode signature issue. However, silly people carve out random microcode blobs from BIOS packages and think are doing other people a service this way...

Block loading of any unreleased standalone Zen5 microcode patches."

The patch will presumably work its way into the mainline Linux kernel in the coming days for this added protection. AMD's details on this security advisory via [4]AMD.com .



[1] https://github.com/google/security-research/security/advisories/GHSA-4xq7-4mgh-gp6w

[2] https://bughunters.google.com/blog/5424842357473280/zen-and-the-art-of-microcode-hacking

[3] https://lore.kernel.org/lkml/20250410114222.32523-1-bp@kernel.org/

[4] https://www.amd.com/en/resources/product-security/bulletin/amd-sb-7033.html


phoronix

They are fools that think that wealth or women or strong drink or even
drugs can buy the most in effort out of the soul of a man. These things offer
pale pleasures compared to that which is greatest of them all, that task which
demands from him more than his utmost strength, that absorbs him, bone and
sinew and brain and hope and fear and dreams -- and still calls for more.
They are fools that think otherwise. No great effort was ever bought.
No painting, no music, no poem, no cathedral in stone, no church, no state was
ever raised into being for payment of any kind. No parthenon, no Thermopylae
was ever built or fought for pay or glory; no Bukhara sacked, or China ground
beneath Mongol heel, for loot or power alone. The payment for doing these
things was itself the doing of them.
To wield oneself -- to use oneself as a tool in one's own hand -- and
so to make or break that which no one else can build or ruin -- THAT is the
greatest pleasure known to man! To one who has felt the chisel in his hand
and set free the angel prisoned in the marble block, or to one who has felt
sword in hand and set homeless the soul that a moment before lived in the body
of his mortal enemy -- to those both come alike the taste of that rare food
spread only for demons or for gods."
-- Gordon R. Dickson, "Soldier Ask Not"