AMD won't patch all chips affected by severe data theft vulnerability — Ryzen 3000, 2000, and 1000 will not get patched for 'Sinkclose'

Comments

• narc0tic_bird@lemm.ee ⁨3⁩ ⁨months⁩ ago

  That’s so stupid, also because they have fixes for Zen and Zen 2 based Epyc CPUs available.

  Intel vs. AMD isn’t “bad guys” vs. “good guys”. Either company will take every opportunity to screw their customers over. Sure, “don’t buy Intel” holds true for 13th and 14th gen Core CPUs specifically, but other than that it’s more of a pick your poison.

  source

  • haui_lemmy@lemmy.giftedmc.com ⁨3⁩ ⁨months⁩ ago

    Tangent: If we started buying risc-v systems we might get to a point where they can actually compete.

    source

    • PrivateNoob@sopuli.xyz ⁨3⁩ ⁨months⁩ ago

      That’s still far away from us as a consumer standpoint, but I’m eagerly waiting for a time when I could buy a RISC V laptop with atleast midrange computing capabalities

      source

      • -> View More Comments
    • conciselyverbose@sh.itjust.works ⁨3⁩ ⁨months⁩ ago

      I’m not buying hardware that doesn’t suit my needs as an investment hoping maybe it eventually will.

      source

      • -> View More Comments
    • Grappling7155@lemmy.ca ⁨3⁩ ⁨months⁩ ago

      Jeff Geerling had a video recently about the state of RISC V for desktop. youtu.be/YxtFctEsHy0?si=SUQBiepSeOne8-2u

      source

      • -> View More Comments
    • narc0tic_bird@lemm.ee ⁨3⁩ ⁨months⁩ ago

      I’m waiting to see how DeepComputing’s RISC-V mainboard for the Framework turns out. I’m aware that this is very much a development platform and far from an actual end-user product, but if the price is right, I might jump in to experiment.

      source

      • -> View More Comments
    • possiblylinux127@lemmy.zip ⁨3⁩ ⁨months⁩ ago

      At the rate we are going Qualcomm might pivot to Risc-V (they are being sued by ARM)

      source

      • -> View More Comments
  • victorz@lemmy.world ⁨3⁩ ⁨months⁩ ago

    How is AMD “screwing us over”? Surely they aren’t doing this on purpose? That seems very cynical.

    source

    • Grippler@feddit.dk ⁨3⁩ ⁨months⁩ ago

      They are 100% intentionally not patching old chips intentionally by not allocating resources to it. It’s a conscious choice made by the company.

      source

      • -> View More Comments
  • Decipher0771@lemmy.ca ⁨3⁩ ⁨months⁩ ago

    “Both sides”

    “Vote third party!”

    Wtf seriously this isn’t the same thing remotely but the arguments used are.

    source

    • umbrella@lemmy.ml ⁨3⁩ ⁨months⁩ ago

      cmon man

      source
• punkfungus@sh.itjust.works ⁨3⁩ ⁨months⁩ ago

  Really not good enough from AMD. I wonder if Intel wasn’t a complete dumpster fire right now if they would still cut off the fix at Zen 3 (I doubt it). There’s really no reason not to issue a fix for these other than they don’t want to pay the engineers for the time to do it, and they think it won’t cost them any reputational damage.

  I hate that every product and company sucks so hard these days.

  source

  • kibiz0r@midwest.social ⁨3⁩ ⁨months⁩ ago

    They did issue a fix: “Buy a new CPU please!”

    That’s why they don’t mind the reputation hit. If 1 person swears allegiance to Intel as a result but 2 people buy new AMD chips, they’re still ahead. And people will forget eventually. But AMD won’t forget the Q3 2024 sales figures.

    source

    • ulterno@lemmy.kde.social ⁨3⁩ ⁨months⁩ ago

      Well, guess who’s not buying next gen Ryzen?

      source
• teawrecks@sopuli.xyz ⁨3⁩ ⁨months⁩ ago

  I feel like this is the perfect place for Right to Repair legislation: the product is broken? And it’s outside your support window? Then give customers what they need to make the fix themselves. It’s not good enough to say “meh, guess you gotta buy one of our newer chips then 🤷”

  source

  • possiblylinux127@lemmy.zip ⁨3⁩ ⁨months⁩ ago

    Especially since the Linux community are the types to go way overkill

    source

    • Vilian@lemmy.ca ⁨3⁩ ⁨months⁩ ago

      Yep, every intel or AMD CPU vulnerability get patched in the kernel before the official firmware patches

      source
• KoalaUnknown@lemmy.world ⁨3⁩ ⁨months⁩ ago

  The enterprise models are getting patched but the consumer ones aren’t. Shame on them.

  source

  • nlgranger@lemmy.world ⁨3⁩ ⁨months⁩ ago

    Consumer usage is not really concerned by the attack scenario of this vulnerability from what I understand. The prerequisite is to have access to the bios so it’s already game over at this point.

    source

    • PM_Your_Nudes_Please@lemmy.world ⁨3⁩ ⁨months⁩ ago

      Sure, but that feels a little bit like saying “We don’t need guards inside the prison, because we already have them patrolling around the perimeter.”

      source
    • WhyJiffie@sh.itjust.works ⁨3⁩ ⁨months⁩ ago

      Chip makes should not only treat customer CPUs as possibly-business hardware when adding shit like (Intel) ME, Pluton and (AMD) PSP, but also when patching serious vulnerabilities and providing support!

      source

      • -> View More Comments
  • possiblylinux127@lemmy.zip ⁨3⁩ ⁨months⁩ ago

    I like my eBay “business” class machines

    source
  • PriorityMotif@lemmy.world ⁨3⁩ ⁨months⁩ ago

    Any news on the “pro” line? They were installed on business PCs and had additional security features built in. For instance there is a 3600 pro model.

    source
• KillingTimeItself@lemmy.dbzer0.com ⁨3⁩ ⁨months⁩ ago

  welp, time to go buy intel… wait.

  source
• eskuero@lemmy.fromshado.ws ⁨3⁩ ⁨months⁩ ago

  lol for the past 15 years I have “rebuilt” my desktop every 5 years but I didn’t expect the would try to force me out of my 7 3700x right on the date

  source

  • Schmuppes@lemmy.world ⁨3⁩ ⁨months⁩ ago

    Which is a shame because our 3700X is still pretty potent for the average user or gamer.

    source

    • eskuero@lemmy.fromshado.ws ⁨3⁩ ⁨months⁩ ago

      Yeah, I have been eyeing upgrades to get avx512 anyway because lately I have been doing very heave very low preset av1 encodes but when they are a dick about it I just feel like postponing it.

      source
    • dinckelman@lemmy.world ⁨3⁩ ⁨months⁩ ago

      At launch, I’ve upgraded my system to a 3900x, and even today, it fulfills my cpu needs. This thing is incredible

      source

      • -> View More Comments
• Chakravanti@lemmy.ml ⁨3⁩ ⁨months⁩ ago

  Lets get shit together and sue them to either fucking do it or open source all their expired hardware.

  I thought i was going to switch to AMD but there’s no PSP switch that I know of and I can switch ME off. I’ll be going with the RISC V before I go anywhere. Fuck these corporations. ALL OF THEM.

  source

  • bruhduh@lemmy.world ⁨3⁩ ⁨months⁩ ago

    Image wake up samurai

    source

    • Chakravanti@lemmy.ml ⁨3⁩ ⁨months⁩ ago

      I don’t play video games anymore. If the game don’t happen on my table, I’ll not consider it to be happening with real people. Regardless of “who” is behind any of the avatars. I can’t see them & IDC if I can only hear them. Maybe deadpool can save us in the next Meta-VR.

      source

      • -> View More Comments
• Kolanaki@yiffit.net ⁨3⁩ ⁨months⁩ ago

  How severe is this vulnerability?

  source

  • ducking_donuts@lemm.ee ⁨3⁩ ⁨months⁩ ago

    The good news is that in order to exploit the new vulnerability, the attacker first has to obtain kernel level access to the system somehow - by exploiting some other vulnerabilities perhaps.

    The bad news is once Sinkclose attack is performed, it can be hard to detect and mitigate: it can even survive an OS reinstall.

    source

    • scoutFDT@lemm.ee ⁨3⁩ ⁨months⁩ ago

      So basically what you are saying is we just need one pvp game with kernel level anti cheat to fuck up somewhere… yeah I’m sure that’s not going to happen.

      source

      • -> View More Comments
    • JASN_DE@lemmy.world ⁨3⁩ ⁨months⁩ ago

      The other bad news: there are so many vulnerabilities on all systems which can be used to gain root-level access, it’s just a matter of time. Also, even future vulnerabilities will be an issue, as the underlying Sinkclose attacks will still work.

      source

      • -> View More Comments
  • TheHolm@aussie.zone ⁨3⁩ ⁨months⁩ ago

    You need to be a root to exploit it, but if it get exploited any way to get rid of it is to throw MB to trash.

    source

    • Appoxo@lemmy.dbzer0.com ⁨3⁩ ⁨months⁩ ago

      Patch/reflash with a new bios?

      source

      • -> View More Comments
• BrightCandle@lemmy.world ⁨3⁩ ⁨months⁩ ago

  AMD has unfortunately a long history of abandoning products before its reasonable on its graphics division. Its not really acceptable, up until earlier this year my NAS/server was running a 3600 and its only for power saving purposes I changed that as its still a very workable CPU in that role.

  source

  • kalpol@lemmy.world ⁨3⁩ ⁨months⁩ ago

    Er I’m still running a FX-8350 as a gaming machine (not AAA games obviously). I had another one as a host for a few VMs and it was more than enough till the motherboard went. One day I’ll upgrade I guess.

    source
• ipkpjersi@lemmy.ml ⁨3⁩ ⁨months⁩ ago

  Yay, another BIOS update!

  I am getting so sick of all these BIOS updates because of all these security vulnerabilities all the time. It is so tiring having to set up my settings all over again all of the time.

  source

  • semperverus@lemmy.world ⁨3⁩ ⁨months⁩ ago

    Back your settings up and restore them then.

    source

    • ipkpjersi@lemmy.ml ⁨3⁩ ⁨months⁩ ago

      Depending on your BIOS and/or motherboard, you can’t restore them between versions. The point of clearing the BIOS settings after flashing a new version is to ensure that you only have values that are expected.

      source

      • -> View More Comments
• Harvey656@lemmy.world ⁨3⁩ ⁨months⁩ ago

  So I have a 3700x, I’ve read about the vulnerability but don’t fully understand it. How at risk am I?

  source

  • ozymandias117@lemmy.world ⁨3⁩ ⁨months⁩ ago

    If an attacker gets access to your system, they will be able to ensure you can’t get rid of the vulnerability

    It will persist across operating system installs

    However, this requires them to get access first

    source

    • Harvey656@lemmy.world ⁨3⁩ ⁨months⁩ ago

      Sounds like it’s time for an upgrade. Never know what kind of weirdos are out there. Thanks for the information.

      source
  • psmgx@lemmy.world ⁨3⁩ ⁨months⁩ ago

    If they get root or admin they can hack the chip itself.

    But minor exploits, nada, no issue, you good. Gotta get root to make it happen.

    Problem is if you, as they say, get got, you have no way of knowing if they’re in your CPU, and no way to fix if they did – basically gotta trash it and replace.

    source
  • ulterno@lemmy.kde.social ⁨3⁩ ⁨months⁩ ago

    In short, if you’re pwned once, you are pwn3d f0r3v#rrrrreeeheehaahaahaa*cough**cough*

    source
  • lambalicious@lemmy.sdf.org ⁨3⁩ ⁨months⁩ ago

    Yes.

    source
• Jumuta@sh.itjust.works ⁨3⁩ ⁨months⁩ ago

  so that means you can internally flash the bios chip from the os?

  would be cool if there were coreboot builds for these platforms, this exploit seems pretty useful

  source

  • zer0squar3d@lemmy.dbzer0.com ⁨3⁩ ⁨months⁩ ago

    Wait yeah can someone explain why this exploit couldn’t be used to say rewrite it to support coreboot and turn this into a good thing?

    source

    • Jumuta@sh.itjust.works ⁨3⁩ ⁨months⁩ ago

      because you need the coreboot people to write firmware that can initialise the system, and that probably takes a lot of reverse engineering

      I don’t know much about this, but I assume there’s little to no effort for corebooting on the amd side, I’ve only seen intels platforms with coreboot sorry

      source

      • -> View More Comments
• 30p87@feddit.org ⁨3⁩ ⁨months⁩ ago

  *Cries in 5 2600 and 1070*

  source

  • KillingTimeItself@lemmy.dbzer0.com ⁨3⁩ ⁨months⁩ ago

    you and me both my friend, you and me both… except for the fact that im still vibing with them. EVGA 1070, i don’t want to give it up F

    source

    • 30p87@feddit.org ⁨3⁩ ⁨months⁩ ago

      My EVGA GTX 1070 SC Gaming ACX 3.0 Black Edition is also holding up strong, especially with AMD FSR or good games (like Metro), but 4k is really bad for the poor little guy :c

      But even with my new PC, he will continue to live in my server :3

      source

      • -> View More Comments
• bruhduh@lemmy.world ⁨3⁩ ⁨months⁩ ago

  Basically, reflash spi chips and it’ll be gone, and to be infected by that, person gotta have physical access to hardware he hacks, and physical access is root access as always has been

  source
• Decronym@lemmy.decronym.xyz ⁨3⁩ ⁨months⁩ ago

  Acronyms, initialisms, abbreviations, contractions, and other phrases which expand to something larger, that I’ve seen in this thread:

  Fewer Letters	More Letters
  IP	Internet Protocol
  NAS	Network-Attached Storage
  SSD	Solid State Drive mass storage

  ---

  [Thread #919 for this sub, first seen 12th Aug 2024, 20:35] [FAQ] [Full list] [Contact] [Source code]

  source
• curry@programming.dev ⁨3⁩ ⁨months⁩ ago

  Shit, I have desktops running with 2200G and 2400G.

  source
• just_another_person@lemmy.world ⁨3⁩ ⁨months⁩ ago

  [deleted]

  source

  • cmnybo@discuss.tchncs.de ⁨3⁩ ⁨months⁩ ago

    They aren’t patching CPUs that were released 5 years ago.

    They should be patching back to Ryzen 1 since those are still perfectly good CPUs. 5-7 years really isn’t that old considering how little improvement there is with each generation.

    source

    • RedWeasel@lemmy.world ⁨3⁩ ⁨months⁩ ago

      Sure, not much per gen, but if you compare say a 1700x vs the current 9700x, you are roughly looking at a 3x improvement in single and multicore performance increase.

      source

      • -> View More Comments
  • 9point6@lemmy.world ⁨3⁩ ⁨months⁩ ago

    What are you on about?

    Ryzen 3xxx series processors are still being sold new today

    The oldest zen processors are only just over half a decade old—a consumer CPU should be expected to be in service at least double that time.

    source

    • Landless2029@lemmy.world ⁨3⁩ ⁨months⁩ ago

      Support should be 5 years after End of Life or end of Manufacturing date.

      source
    • Appoxo@lemmy.dbzer0.com ⁨3⁩ ⁨months⁩ ago

      AMD is producing them new or your local shop us? Because AMD doesnt care about your local tech shop dead stock.

      source

      • -> View More Comments
  • ShortN0te@lemmy.ml ⁨3⁩ ⁨months⁩ ago

    The Ryzen 5 3600 is from 2019. The XT refreshes so Ryzen 5 3600xt from mid 2020

    source
  • cron@feddit.org ⁨3⁩ ⁨months⁩ ago

    Ryzen 2000 and 3000 are still fairly recent and were announced 5-6 years ago.

    source
  • TheHolm@aussie.zone ⁨3⁩ ⁨months⁩ ago

    3600 was released in 2019. And it they was making it for at least 2 years.

    source
  • Auli@twit.social ⁨3⁩ ⁨months⁩ ago

    @just_another_person @TheHolm where do you get the 15 year old hardware from?

    source
• pewgar_seemsimandroid@lemmy.blahaj.zone ⁨3⁩ ⁨months⁩ ago

  custom firmware!

  source

  • kugmo@sh.itjust.works ⁨3⁩ ⁨months⁩ ago

    Does not exist for Ryzen because of AGESA licensingnq

    source

    • pewgar_seemsimandroid@lemmy.blahaj.zone ⁨3⁩ ⁨months⁩ ago

      Arrrr?

      source

      • -> View More Comments
• faethon@lemmy.world ⁨3⁩ ⁨months⁩ ago

  AMD published a list with the mitigation on Sinkclose on all their processor ranges, and the ComboPI version that will have a patch!

  Security bulletin 7014

  source
• jbk@discuss.tchncs.de ⁨3⁩ ⁨months⁩ ago

  anyone know how intel’s microcode update policy is in comparison to AMD’s?

  source
• Boomkop3@reddthat.com ⁨3⁩ ⁨months⁩ ago

  Welp, glad I avoided that

  source