Requires kernel-level access. Also AMD is “releasing mitigations”, so is it “unfixable?”
‘Sinkclose’ Flaw in Hundreds of Millions of AMD Chips Allows Deep, Virtually Unfixable Infections
Submitted 3 months ago by nzmaa@lemy.lol to technology@lemmy.world
https://www.wired.com/story/amd-chip-sinkclose-flaw/
Comments
avidamoeba@lemmy.ca 3 months ago
Drathro@dormi.zone 3 months ago
I think they meant it as “once infected may be impossible to disinfect.” But it sure doesn’t read that way at first glance.
WHYAREWEALLCAPS@fedia.io 3 months ago
Did they change it? Because now it says "Allows Deep, Virtually Unfixable Infections" and that seems to say exactly what you are.
Bjornir@programming.dev 3 months ago
If you have kernel access you can already do almost everything so a vulnerability on top of that isn’t that bad since no one should have kernel access to your computer
rob_t_firefly@lemmy.world 3 months ago
“They’re going for the kernel!”
"Colonel who?"
someguy3@lemmy.world 3 months ago
Requires kernel-level access
What does that mean to the rest of us?
floofloof@lemmy.ca 3 months ago
It means that a malicious actor would already need to have hacked your computer quite deeply through some other vulnerability (or social engineering) before they could take advantage of this one. But I don’t agree with another commenter here that this is a “nothingburger”: this vulnerability enables such a hacker to leave undetectable malware that you just can’t remove from the computer even if you replace everything but the motherboard. That’s significant, particularly for anyone who might be a target of cyber-espionage.
avidamoeba@lemmy.ca 3 months ago
Festivus
mox@lemmy.sdf.org 3 months ago
LainTrain@lemmy.dbzer0.com 3 months ago
More “cybersecurity” clickbait with red/blue/green images of processors and skulls. That’s the real “infection”
rickyrigatoni@lemm.ee 3 months ago
who is naming this shit
riskable@programming.dev 3 months ago
A list of the effected processors would’ve been nice, Wired.
vikingtons@lemmy.world 3 months ago
The article links to this:
mox@lemmy.sdf.org 3 months ago
It gave one:
but it pointed to a full list of affected products that can be found on its website’s [security bulletin page](but it pointed to a full list of affected products that can be found on its website’s security bulletin page..
Rayspekt@lemmy.world 3 months ago
So what do I exactly need to do if I have ine if the affected CPUs? What specifically do I need to patch?
dogslayeggs@lemmy.world 3 months ago
I’m not an expert, but reading the posts here the answer seems to be “nothing.” The only people affected by this already know how to prevent it.
vikingtons@lemmy.world 3 months ago
You’ll want to upgrade your system BIOS when your board vendor makes this fix available.
FangedWyvern42@lemmy.world 3 months ago
Nothing. It sounds like it only affects a very small number of people, but the general public has no need to worry.
vext01@lemmy.sdf.org 3 months ago
Oopsy!
notnotmike@programming.dev 3 months ago
I mean, I’m not much of a tinfoil hat, but this article feels extremely conveniently timed for Intel, who is currently going through a massive ordeal with their chips. Especially considering that the vulnerability is so extremely difficult to exploit that there’s borderline no story here for 99% of people but the headline will still drive clicks and drama.
Drathro@dormi.zone 3 months ago
Difficult to exploit, already in the process of being patched. Truly, the most breaking of news.
httperror418@lemmy.world 3 months ago
How does the patch actually get delivered? Via windows update or using something else?
TheGrandNagus@lemmy.world 3 months ago
Intel has literally done this, and stuff like it before.
They back “independent” researchers who twist themselves in knots to make AMD look bad.
Look up the multiple counts of bullshit from a “research group” called Principled Technologies.
Sidenote: the guy who ran it was Ryan Shrout, who used to work for PC Perspective, and would usually give favourable reviews to Intel. After leaving Principled Technologies, he got a high up marketing position at… drumroll… Intel!
Principled Technologies isn’t the only scam “independent researcher” Intel has set up or paid handsomely either.
deuleb_biezelbob@programming.dev 3 months ago
I thought switching to AMD should’ve kept me save from Intel ME (I used ME_cleaner if I had too) :(
heavy@sh.itjust.works 3 months ago
I loathe what part of the security community has become with the stunt hacking and vuln naming. That being said, I doubt it’s some conspiracy. I don’t know all the details but it wouldn’t be exceptional to identify a bug that has existed in processor firmware or legacy code for a long time.
People are looking at this stuff all the time, both professionally and for fun. You could make the case that it’s inevitable that there will be exploits found that affect a huge population.
In the end, as long as the layman gets smarter about computer security, the better people will react to vuln drops.
sudo42@lemmy.world 3 months ago
Not too unusual. There have been a lot of new vulnerabilities announced lately. A few months ago they announced one that exposed all (?) mainstream CPUs, even Apple’s new chips.
Some of the vulns are serious, but many require very specific circumstances to actually work.
megaman@discuss.tchncs.de 3 months ago
The folks who found it are presenting at Defcon this weekend, according to the article.
I imagine some of the industry press (i.e. Wired) are just looking through the Defcon agenda to figure out what to write. I saw two or three other articles about hacks or exploits and things like that that also mentioned it was bring presented at Defcon.
ruse8145@lemmy.sdf.org 3 months ago
Was there a real user risk to any of the flaws since heart bleed? Or did people mostly want to hate on Intel? I’m no tinfoil hatter either I’m just asking questions.
Passerby6497@lemmy.world 3 months ago
13th and 14th generation Intel processors can be physically damaged and degrade over time on the latest issue from Intel.
beefbot@lemmy.blahaj.zone 3 months ago
Every last news article you see, you must ask: who benefits from this article’s appearance?
It’s not just judges who can be bought.