Here we are - 3600 which was still under manufacture 2-3 years ago are not get patched. Shame on you AMD, if it is true.
custom firmware!
Does not exist for Ryzen because of AGESA licensingnq
Arrrr?
The fuck are you trying to say? Speak English. Also no one at coreboot has publicly released (or developed?) anything for AM4 and you can’t access AGESA code to patch it yourself.
removed by mod
I don’t think they’re suggesting taking it away from the rightful owner.
removed by mod
So I have a 3700x, I’ve read about the vulnerability but don’t fully understand it. How at risk am I?
Yes.
In short, if you’re pwned once, you are pwn3d f0r3v#rrrrreeeheehaahaahaa*cough**cough*
These are the kinds of exploits you use to create APT (Advanced Persistent Threats).
If an attacker gets access to your system, they will be able to ensure you can’t get rid of their access
It will persist across operating system installs
However, this requires them to get access first
Sounds like it’s time for an upgrade. Never know what kind of weirdos are out there. Thanks for the information.
If they get root or admin they can hack the chip itself.
But minor exploits, nada, no issue, you good. Gotta get root to make it happen.
Problem is if you, as they say, get got, you have no way of knowing if they’re in your CPU, and no way to fix if they did – basically gotta trash it and replace.
Not particularly. The exploit requires ring 0 access, if an attacker managed to get that, you are screwed already.
Acronyms, initialisms, abbreviations, contractions, and other phrases which expand to something larger, that I’ve seen in this thread:
Fewer Letters More Letters IP Internet Protocol NAS Network-Attached Storage SSD Solid State Drive mass storage
3 acronyms in this thread; the most compressed thread commented on today has 4 acronyms.
[Thread #919 for this sub, first seen 12th Aug 2024, 20:35] [FAQ] [Full list] [Contact] [Source code]
AMD has unfortunately a long history of abandoning products before its reasonable on its graphics division. Its not really acceptable, up until earlier this year my NAS/server was running a 3600 and its only for power saving purposes I changed that as its still a very workable CPU in that role.
Er I’m still running a FX-8350 as a gaming machine (not AAA games obviously). I had another one as a host for a few VMs and it was more than enough till the motherboard went. One day I’ll upgrade I guess.
I moved from an FX8350 to a R5 5600G a few years ago, having run it for about 9 years. Initially I didn’t think I’d notice much difference, but frankly it’s an entirely different ballgame.
Single core performance is niiice
Oh yeah I plan to update. But only when I really get annoyed.
Yay, another BIOS update!
I am getting so sick of all these BIOS updates because of all these security vulnerabilities all the time. It is so tiring having to set up my settings all over again all of the time. Earlier this year, or maybe it was last year, it felt like every month or two there was a new BIOS update for a new security vulnerability.
Back your settings up and restore them then.
Depending on your BIOS and/or motherboard, you can’t restore them between versions. The point of clearing the BIOS settings after flashing a new version is to ensure that you only have values that are expected, which is why restoring backups can often be blocked between versions.
I learned this the hard way when I lost all my fan profiles
Thankfully that’s one thing that can be restored between BIOS versions for my motherboard lol
Not on mine :(
welp, time to go buy intel… wait.
You laugh, but if you’re buying used, this 100% makes Intel the way to go over a Ryzen 1000/2000/3000 CPU.
as long as we’re buying 12th gen, we’re ok.
I dont know.
If I had my choice between a CPU that has a vulnerability that can only be exploited if the system is already compromised
or a CPU that are full of oxidation cancer, or frying themselves and doing irreparable damage… Which the company is being excessively shady about concretely admitting to any RMA promises and wwill all eventually die in short order…
I think I’m gonna go with the Ryzen and not leave leave my computer outside at defcon.
Sure but we’re talking about several generation old CPUs: nothing’s wrong with Intel’s 10/9/8th gen CPUs, which would be the contemporary ones to the Ryzen chips in question.
Risc-V is the real response to this problem
removed by mod
As much as I like RISC-V, it is kind of ironic to suggest RISC-V ist the solution to this. At least as it stands, because of RISC-V’s simplicity, most if not all current RISC-V CPUs don’t even run microcode, so there is nothing to update/fix in case of a CPU bug. There’s even a very current example of this problem with that chinese RISC-V cpu that has this “GhostWrite” bug that allows every unpriviliged process to gain root access.
As I said in an other reply, RISC-V is not the solution for the reason that they are perfect today. It is because it is not limited to being used by a few megacorporations that do whatever they want, but it allows competition where companies do what they need to become and remain a good choice.
Now we just need a friendly neighbourhood nanoscale fab.
I understood that. My point was rather that in this particular case (a CPU bug that could be fixed via microcode, but AMD chose not to do so for certain CPUs), RISC-V wouldn’t have been of any advantage, because there would be nothing to fix in the first place. Sure, one could introduce microcode for RISC-V and people have argued in favor of doing so for this exact reason, but the architecture was intentionally designed to not require microcode.
How is that? Does risc-v have magical properties that make its designers infallible, or somehow make it possible to fix flaws in the physical design after the CPU has already been fabbed and sold?
Because it does not set in stone that there can be only 2 companies producing compatible chips, which can be however bad until both of them does the same shit practices.
So the short answer is by not stifling competition.
So what you are saying is, it’s just as Risc-E
lol for the past 15 years I have “rebuilt” my desktop every 5 years but I didn’t expect the would try to force me out of my 7 3700x right on the date
deleted by creator
Yeah, I have been eyeing upgrades to get avx512 anyway because lately I have been doing very heave very low preset av1 encodes but when they are a dick about it I just feel like postponing it.
At launch, I’ve upgraded my system to a 3900x, and even today, it fulfills my cpu needs. This thing is incredible
Yea i got the 3900xt when i built my pc during covid. Love it but i had to disable a bunch of shit to prevent bluescreens from hypervisor shit
Attackers need to access the system kernel to exploit the Sinkclose vulnerability, so the system would have to already be compromised. The hack itself is a sophisticated vector that is usually only used by state-sponsored hackers, so most casual users should take that into account.
So it’s a vulnerability that requires you to.already have been compromised. Hardly seems like news.
I can understand AMD only patching server chips that by definition will be under greater threat. On the other hand it’s probably not worth the bad publicity not to fix more.
The reason that this is news is because it allows malware to embed itself into the processor microcode once kernel is breached. IE: If it is exploited for compromise, you either have to have the knowledge and hardware to reset the processor microcode manually (Requires an SPI flash tool) or you toss the hardware entirely. There’s no just ‘blow the drive away and reinstall the OS’ solution available.
I don’t think it gets to the microcode but the UEFI.
And that introduces a specific type of supply chain threat: someone who possesses a computer can infect their own computer, sell it or transfer it to the target, and then use the embedded microcode against the target, even if the target completely reformats and reinstalls a new OS from scratch.
That’s not going to affect most people, but for certain types of high value targets they now need to make sure that the hardware they buy hasn’t already been infected in the supply chain.
This sounds weird. I was in the impression that operating systems load updated cpu microcode at every boot, because it does not survive a power cycle, and because the one embedded in the BIOS/UEFI firmware is very often outdated. But then how exactly can a virus persist itself for practically forever?
The OS can’t get to the point of loading cpu microcode without that outdated, embedded microcode. The reason it can persist is because there aren’t a lot of good ways to see what that UEFI microcode actually is once it’s installed. Plus, only the UEFI tells you that it has successfully updated itself. There is no other more authoritative system to verify that against. So the virus could just lie and say it’s gone and you would never know. Hence needing to treat it as the worst case scenario, that it never leaves.
That being said it builds up vulnerabilities in anti-cheats to another beautiful crowstrike like domino cluster fuck
It’s important because it allows them to directly modify the CPU’s microcode. Basically, the CPU has its own set of instructions, called microcode, which controls how the chip functions on a physical level. If they manage to change your microcode, even a full system reformat won’t kill the virus; You’ll need to either re-flash the CPU (which is not something the standard user or even power user will know how to do) or replace the entire CPU.
I personally agree. I think it’s being somewhat overhyped. If step one is physical access to get things rolling… like for sure some machines are in more public areas than others. But for me, someone would have to break into my house first, then access my machine, just to run exploits later. The exploit is pretty massive, but I think needs to be tempered with “first they need physical access”. Because physically controlling machines has always been number 1 for security.
AMD published a list with the mitigation on Sinkclose on all their processor ranges, and the ComboPI version that will have a patch:
I feel like this is the perfect place for Right to Repair legislation: the product is broken? And it’s outside your support window? Then give customers what they need to make the fix themselves. It’s not good enough to say “meh, guess you gotta buy one of our newer chips then 🤷”
Especially since the Linux community are the types to go way overkill
Yep, every intel or AMD CPU vulnerability get patched in the kernel before the official firmware patches
deleted by creator
The enterprise models are getting patched but the consumer ones aren’t. Shame on them.
I like my eBay “business” class machines
Consumer usage is not really concerned by the attack scenario of this vulnerability from what I understand. The prerequisite is to have access to the bios so it’s already game over at this point.
Chip makes should not only treat customer CPUs as possibly-business hardware when adding shit like (Intel) ME, Pluton and (AMD) PSP, but also when patching serious vulnerabilities and providing support!
When you pay for enterprise equipment, you are typically paying a premium for longer, more robust support. Consumer products are less expensive because they don’t get this support.
But they are already pretending for whatever reason that these are suitable for enterprises, by always includingthe aformentioned remote control components!
Agreed, firmware security by chip manufacturers has been underwhelming to say the least and we can blame them for that. But in this specific instance I still don’t see the benefit of a fix for consumer usage. Companies have a responsibility and accountability toward their users, so a fix is due, for personal laptops/PCs the threat is toward the owners themselves (activists, diplomats, journalists, etc.). The latter do not buy second hand equipment, and if the firmware is compromised while they own it, they are already in danger.
The latter do not buy second hand equipment
You are assuming activists are well funded in some way, and that they are not repressed.
This obviously has a benefit for consumer usage too, same as encryption. You’re basically saying consumers don’t need any kind of antivirus either, because it’s not that critical.
This vuln should have been fixed for consumer hardware too, because it basically permanently taints all hardware that is vulnerable to it. And what makes it so hard to release patches for consumer hardware, when patches were already made for the same generations of enterprise hardware? Basically the majority of the work has been done alreadyI’m not saying this is a small issue and nothing should be done. I just noted that the issue is not as big as some other hardware-based vulnerabilities we encountered in the past. And every threat model calls for a corresponding counter-measure.
You are assuming activists are well funded in some way, and that they are not repressed. I’m assuming they are repressed, which is why they have people that buy and configure their equipment and hand it to them so that it hasn’t been tampered with. If you cannot afford that your should use your computer as if it was compromised.
You’re basically saying consumers don’t need any kind of antivirus either Where did I write that?
And what makes it so hard to release patches for consumer hardware. AMD focusing on where its money’s at and OEM/motherboard manufacturers being cheap and lazy and not pushing forward updates when they have them.
Sure, but that feels a little bit like saying “We don’t need guards inside the prison, because we already have them patrolling around the perimeter.”
Any news on the “pro” line? They were installed on business PCs and had additional security features built in. For instance there is a 3600 pro model.
Shit, I have desktops running with 2200G and 2400G.
Welp, glad I avoided that
deleted by creator
They aren’t patching CPUs that were released 5 years ago.
They should be patching back to Ryzen 1 since those are still perfectly good CPUs. 5-7 years really isn’t that old considering how little improvement there is with each generation.
Sure, not much per gen, but if you compare say a 1700x vs the current 9700x, you are roughly looking at a 3x improvement in single and multicore performance increase.
Most of desktop users don’t care at all about these gains. Slap in normal ram and an SSD and a 1000 series Ryzen is ready to be a run of the mill desktop, that browses and can show media no problem.
I care! But I’m a power user. Most aren’t.
I suppose that is true. Intel seems to think so as well as their low power n100 is about the performance of a 1500x.
@just_another_person @TheHolm where do you get the 15 year old hardware from?
My threadripper 1950x is from 2017… and is the cpu powering my primary hypervisor perfectly fine. That’s not 18 years ago, that’s not even 8 years ago.
Some people really don’t think before they speak do they
3600 was released in 2019. And it they was making it for at least 2 years.
deleted by creator
What are you on about?
Ryzen 3xxx series processors are still being sold new today
The oldest zen processors are only just over half a decade old—a consumer CPU should be expected to be in service at least double that time.
AMD is producing them new or your local shop us? Because AMD doesnt care about your local tech shop dead stock.
Maybe they should, and also care about the many people still using these processors that are not very old.
Support should be 5 years after End of Life or end of Manufacturing date.
The Ryzen 5 3600 is from 2019. The XT refreshes so Ryzen 5 3600xt from mid 2020
Ryzen 2000 and 3000 are still fairly recent and were announced 5-6 years ago.
