It feels like every month brings news of another security flaw impacting a vast array of consumer-grade CPUs. Given the ever-increasing complexity of modern processors and the systems they power, it’s perhaps not surprising that these vulnerabilities keep emerging.
The latest issue, however, is particularly significant as it affects AMD processors and stretches back across multiple generations of CPUs — some of which are so old they’re no longer supported and may never receive a fix.
Known as the “Sinkclose” flaw, this vulnerability allows compromised PCs to execute unchecked code on an AMD Ryzen processor within System Management Mode, bypassing security measures in both Windows and most BIOS and UEFI configurations. Researchers from IOActive unveiled the flaw at Defcon.
Once a system is compromised, it could be infected with bootkits capable of evading traditional security tools, including antivirus software and Windows’ built-in defenses. Alarmingly, the infection could persist even after a full reinstallation of the operating system.
Researcher Enrique Nissim explained the complex steps required to remove the infection from the PC’s memory and concluded by saying, “You basically have to throw your computer away.”
AMD has acknowledged the security flaw and claims to have already “released mitigation options” for Ryzen-based PCs and industrial data center machines, with updates for embedded AMD hardware, such as the APUs in gaming consoles, expected soon.
The list of affected products provided by AMD includes chips dating back to the Ryzen 3000 series from 2019, all of which are slated to receive updates to address the vulnerability.
However, this list conflicts with a report shared with Wired, which indicates that the vulnerability may affect chips as far back as 2006. Most of these older chips are no longer supported, and while many of them may no longer be in use, the sheer volume of affected machines means that some are likely still operational, possibly even running critical infrastructure.
On the bright side, this vulnerability doesn’t seem easy to exploit, at least not yet. Researchers are giving AMD time to issue patches before fully disclosing the details. To exploit the flaw, a program would need kernel-level access to inject code into the pre-OS boot sequence. Microsoft and its OEM partners are expected to roll out updates soon to patch the vulnerability on current systems.
Unfortunately, kernel-level vulnerabilities, while technically challenging to exploit, are fairly common. They’re precisely the kind of vulnerabilities that attract the attention of state-sponsored hackers and industrial espionage groups, given their power and the potential for widespread exploitation.
