AMD Patches CPU Vulnerability That Could Break Confidential Computing Protections

[securitybreach]

Quote

 

AMD on Monday announced patches for a microprocessor vulnerability that could lead to loss of Secure Encrypted Virtualization (SEV) protection, allowing attackers to load malicious microcode.

 

Tracked as CVE-2024-56161 (CVSS score of 7.2), the bug is described as an improper signature verification in the microcode patch loader on the AMD CPU read-only memory.

 

The security defect “may allow an attacker with local administrator privilege to load malicious CPU microcode resulting in loss of confidentiality and integrity of a confidential guest running under AMD SEV-SNP,” AMD explains in its advisory.

Given that microcode is typically loaded at boot, loading malicious microcode could allow attackers to tamper with the CPU functionality.

AMD rolled out mitigations to prevent the loading of malicious microcode, warning that SEV-SNP attestation support requires an SEV firmware update on some platforms.

 

“Updating the system BIOS image and rebooting the platform will enable attestation of the mitigation. A confidential guest can verify the mitigation has been enabled on the target platform through the SEV-SNP attestation report,” AMD explains.

 

 

https://www.securityweek.com/amd-patches-cpu-vulnerability-found-by-google/