Arthur BesseA to

SecurityEnglish · 2 days ago

AMD Zen 1 through Zen 4 CPUs use an insecure hash function in the signature validation for microcode updates; researchers released a proof of concept update which makes the RDRAND instruction return 4

5

35

AMD Zen 1 through Zen 4 CPUs use an insecure hash function in the signature validation for microcode updates; researchers released a proof of concept update which makes the RDRAND instruction return 4

Arthur BesseA to

SecurityEnglish · 2 days ago

5

AMD: Microcode Signature Verification Vulnerability

### Summary Google Security Team has identified a security vulnerability in some AMD Zen-based CPUs. This vulnerability allows an adversary with local administrator privileges (ring 0 from outside...

for readers missing the significance of the number 4 in the proof of concept: to demonstrate this vulnerability the researchers created a microcode update which replaces the “hardware” random number generator behind the RDRAND instruction with an implementation of xkcd#221 😭

Chat

propter_hog [none/use name]@hexbear.net
link
fedilink
English
arrow-up
9·
2 days ago
Relevant xkcd: https://xkcd.com/221/
- propter_hog [none/use name]@hexbear.net
  link
  fedilink
  English
  arrow-up
  4·
  2 days ago
  Ah shit, I just saw you posted the same thing in the body text