AMD: Microcode Signature Verification Vulnerability
github.com
### Summary Google Security Team has identified a security vulnerability in some AMD Zen-based CPUs. This vulnerability allows an adversary with local administrator privileges (ring 0 from outside...

for readers missing the significance of the number 4 in the proof of concept: to demonstrate this vulnerability the researchers created a microcode update which replaces the “hardware” random number generator behind the RDRAND instruction with an implementation of xkcd#221 😭

  • tiddyEnglish
    1·
    8 小时前

    Pretty sure it means the equivalent of root on baremetal (ie ring 0 in a vm is still safe).

    Pretty sure on top of that anyone with that access can essentially rewrite your CPU’s brain, allowing ring 0 access even after (for example) selling the CPU.

    • chingadera@lemmy.world
      1·
      5 小时前

      Didn’t think anyone was gonna get back to me on this, thanks Tiddy.

      If you had ring 0 on the bare metal, isn’t it safe to assume that anything that bare metal has, including installed vms is also compromised or easily compromisable?

      I’m not too knowledgeable on security yet but this interested me