cynicalsecurity :cm_2: on Nostr: From Bluesky it turns out that AMD microcode can be injected in certain cores ...
From Bluesky it turns out that AMD microcode can be injected in certain cores bypassing security checks because a weak hash function is used¹…
We have seen this before, of course, all the way back to the AMD K8 core in a very simple and short article by TESO.
I remember it well, I used it in my research and subsequent hacks, but it does leave me rather surprised that this is happening again.
On a separate note: I think having the possibility to modify microcode is wonderful and fun. It is an assembler to the processor, it lets you do some weird and wonderful things within the space of the microcode update store, of course (and its volatility: it has to be re-injected at boot, for a good reason, believe me
)
__
¹
https://github.com/google/security-research/security/advisories/GHSA-4xq7-4mgh-gp6wPublished at
2025-02-03 20:27:12 UTCEvent JSON
{
"id": "3573e4a6c26dfd7956ca12eb37bf7c1c659b6b2e5976fecdf1ef7dd8b5eeab63",
"pubkey": "1d8b985dd6b02c695578cdafb587094e48ff3db8e750b8dd6fde21d96fd5ec24",
"created_at": 1738614432,
"kind": 1,
"tags": [
[
"emoji",
"flan_XD",
"https://media.bsd.network/custom_emojis/images/000/010/254/original/flan_XD.png"
],
[
"proxy",
"https://bsd.network/users/cynicalsecurity/statuses/113941835420454406",
"activitypub"
]
],
"content": "From Bluesky it turns out that AMD microcode can be injected in certain cores bypassing security checks because a weak hash function is used¹… \n\nWe have seen this before, of course, all the way back to the AMD K8 core in a very simple and short article by TESO.\n\nI remember it well, I used it in my research and subsequent hacks, but it does leave me rather surprised that this is happening again.\n\nOn a separate note: I think having the possibility to modify microcode is wonderful and fun. It is an assembler to the processor, it lets you do some weird and wonderful things within the space of the microcode update store, of course (and its volatility: it has to be re-injected at boot, for a good reason, believe me :flan_XD:)\n\n__\n¹ https://github.com/google/security-research/security/advisories/GHSA-4xq7-4mgh-gp6w",
"sig": "abfa17d7982821acb8ffee55dc80c488cd38243e1f71171cf742614ae54289c82a7822cac57d8928ca794e85a37a9d14845ca5966bb7feaddbb25dec73261a82"
}
