For users seeking to protect themselves, Nissim and Okupski say that for Windows machines—likely the vast majority of affected systems—they expect patches for Sinkclose to be integrated into updates shared by computer makers with Microsoft, who will roll them into future operating system updates. Patches for servers, embedded systems, and Linux machines may be more piecemeal and manual; for Linux machines, it will depend in part on the distribution of Linux a computer has installed.
The headline is misleading: the bug is just as fixable as any, and firmware updates are expected to fix it. AMD do not have a “near-unfixable” processor vulnerability.
What’s “near-unfixable” is a deeply embedded bootkit dropped through the successful exploitation of this bug, since it can make itself invisible to the OS and anti malware tools, and could survive a reinstallation of the OS.
Telorand@reddthat.com 3 months ago
As pointed out elsewhere, the attack requires kernel-level access, and anyone with that access can do a lot of damage anyway.
And the flaw can be fixed (there’s a fix out), it’s just that there’s no remediation once the flaw has been exploited.
sun_is_ra@sh.itjust.works 3 months ago
It also means no AMD server could be resold because there is no way to know if it was previously infected
mox@lemmy.sdf.org 3 months ago
One of these things is not like the other.
conciselyverbose@sh.itjust.works 3 months ago
Yeah, turning an exploit into one that survives a fresh install is a huge deal.
Telorand@reddthat.com 3 months ago
They’re intrinsically linked, in fact. If you have kernel access, you can do any number of things, including but not limited to persistent rootkits. I agree that this bug is one step further, since it affects the processor itself, but if somebody has ring 0 access that shouldn’t, you already have problems.
Shdwdrgn@mander.xyz 3 months ago
Read it again, in context. What they said is perfectly valid.