• hoyski@lemmy.world
    link
    fedilink
    English
    arrow-up
    1
    ·
    4 days ago

    The researchers discovered that AMD had been using a publicly available example key from NIST documentation since Zen 1…

    The perils of cut/paste

  • TheGrandNagus@lemmy.world
    link
    fedilink
    English
    arrow-up
    1
    ·
    edit-2
    6 days ago

    This flaw allows attackers with local administrator privileges to bypass AMD’s cryptographic verification system and install custom microcode updates on affected CPUs.

    If you already have local administrator privileges, you have access to the system and its data anyway. Doesn’t seem that critical a flaw. It doesn’t even survive reboots.

    Regardless, AMD has already issued a fix.

    • palordrolap@fedia.io
      link
      fedilink
      arrow-up
      0
      ·
      5 days ago

      local administrator privileges

      … are used by distro update mechanisms and very few people turn those off, even if they don’t use elevated privileges for anything else.

      Admittedly, it’s unlikely that a distro’s repository will end up with a compromised microcode package, but it’s not impossible (Remember the 7zip debacle?). And if it happens, you can be sure that whoever designs the payload will use the temporary access to install something ugly that has more permanent access.

      But as you say, AMD have issued a fix. And that’d be why.

        • palordrolap@fedia.io
          link
          fedilink
          arrow-up
          2
          ·
          3 days ago

          Whoops. It looks like I conflated it with the more recent 7zip vulnerability, which didn’t affect Linux much at all.

          Just goes to show how often these things crop up though.