AMD Ryzen and EPYC has big security flaws

AMD Ryzen CPU family

Masterkey, according to CTS-Labs, allows the injection of persistent malware into the Secure Processor, among other attacks.

While the vulnerabilities all require administrator access before they can be exploited, making them significantly more hard for intruders to use, they are risky in that they allow complete access to the system, including secure processing areas normally off-limits to malware.

The flaws were uncovered by Israeli security firm CTS-Labs, which noted that the vulnerabilities affect the Secure Processor, a co-processor found on AMD's CPUs where sensitive data such as encryption keys and passwords are stored.

The second, dubbed Ryzenfall, consists of four "design and implementation flaws" inside the AMD Secure OS, which powers the AMD Secure Processor found in Ryzen, Ryzen Pro and Ryzen Mobile products.

"You're virtually undetectable when you're sitting in the secure processor", Luk-Zilberman said of the flaws. CTS-Labs claims it's been able to exploit the vulnerabilities it found on several Ryzen chips, but no potential attack has been seen in the wild.

Fallout exposes the bootloader within the Epyc Secure Processor, allowing access to protected memory regions, CTS-Labs claims. It's also worth noting that AMD has been made aware of the issues, as have "select security companies" that could help mitigate the fallout and USA regulators. CTS-Labs blamed ASMedia, a third-party chipmaker that supplied the USB host controller and SATA controller within AMD's Ryzen chipset, for these vulnerabilities, which were then introduced into the Ryzen chipsets.

"CTS believes that networks that contain AMD computers are at a considerable risk", the report said. "The vulnerabilities we have discovered allow bad actors who infiltrated the network to persist in it, surviving computer reboots and reinstallations of the operating system, while remaining virtually undetectable by most endpoint security solutions", the advisory said. We are actively investigating and analyzing its findings. However, the outfit gave AMD a week to come up with a fix before it went public.

AMD Ryzen architecture
Researchers claim AMD flaws threaten Ryzen, EPYC chips

Investment firm Viceroy Research published a 25-page report on the issues after the company said it was anonymously emailed a copy of CTS' findings on Monday afternoon.

AMD confirmed it's been made aware of the potential vulnerabilities.

An AMD spokesperson told CNET it is investigating the report, which they "just received".

"At AMD, security is a top priority and we are continually working to ensure the safety of our users as new risks arise", the California-based company said in a statement.

We will update this story when more information is available.

As with the Spectre and Meltdown vulnerabilities, it will take time for the true nature of the risk to become clear, but already security commentators appear to be divided in their opinion.

This could allow attackers "to inject malicious code into the chip" and create "an ideal target" for hackers, the researchers said.

Turkish military says it has encircled city of Afrin
It's not clear if Turkey will immediately advance on Manbij after Afrin, or if the fall of the district will lead to a pause. Turkey says it has now besieged the town of Afrin and is ready to enter the city "at any moment".

Margot Robbie in talks to play Sharon Tate in Tarantino film
Sony Pictures is backing Quentin Tarantino's next movie, that already had Leonardo DiCaprio on board. But Rick has a very famous next-door neighbor ...

Walmart expanding online grocery service
Amazon also has spent over a decade trying to build up its AmazonFresh grocery delivery service , but so far seen limited success. Walmart's new service could also be a response to Amazon's $13.2 billion purchase past year of Whole Foods.


  • Creation of digital currencies carries 'significant fraud risks'

    Creation of digital currencies carries 'significant fraud risks'

    Last month U.S. regulators joined a growing chorus of officials saying they may need new powers to regulate cryptocurrencies. The report points that the BIS is watchful of central banks issuing their own digital tokens.
    Sarah Drew and Michelle Hurd Cast in Cagney & Lacey Reboot

    Sarah Drew and Michelle Hurd Cast in Cagney & Lacey Reboot

    Michelle Hurd's character Mary Beth Lacey will be athletic, polished, and a former high school track and field champion. Blindspot alum Michelle Hurd has been cast as fellow co-lead Lacey in the reboot of the iconic 1980s police procedural.
    Trump backs changes to gun laws, proposes arming teachers

    Trump backs changes to gun laws, proposes arming teachers

    Trump tweeted on Monday that the White House would support gun control measures approved by the NRA but not changing age limits. He has called for raising the minimum age for purchasing an AR-15 or similar-style rifles from 18 to 21 years old.
  • Becky Lynch Talks Thoughts On Alexa Bliss, Fabulous Moolah Battle Royal

    Becky Lynch Talks Thoughts On Alexa Bliss, Fabulous Moolah Battle Royal

    The announcement of the match came by a video package which indicated that women from every WWE brand, including NXT would compete.
    Why President Trump Fired Rex Tillerson

    Why President Trump Fired Rex Tillerson

    At one point previous year , Tillerson reportedly called Trump "a moron" after a national security meeting. Later Tuesday, it was announced he would be replaced by State Department spokesperson Heather Nauert.
    Raees Actor, Narendra Jha, Passes Away

    Raees Actor, Narendra Jha, Passes Away

    This was the third attack that he has had over the years. "He had no health issues and last night he was fine". Dear Narendra Jhan, rest in peace! Sanjay Gupta, who directed Jha in Kaabil , tweeted, "I refuse to accept it.
  • Teacher accidentally fires gun and injures student during safety lesson

    Teacher accidentally fires gun and injures student during safety lesson

    He told KSBW that Alexander had told the class that he wanted to make sure the gun wasn't loaded when it accidentally discharged. He adds that, "Clearly, we will revisit this incident to ensure that something like this would never happen again".
    Maruti Suzuki to launch cars with 6-speed gearbox this year

    Maruti Suzuki to launch cars with 6-speed gearbox this year

    The carmaker is in a process to launch a six-speed gearbox this year, which will improve the driving performance of the vehicle . For instance, cruising speed of 80-100km/hour on the highway can be done in the sixth gear rather than in the fifth gear.
    'BTS: Burn the Stage' to Follow K-Pop Group Behind the Scenes!

    'BTS: Burn the Stage' to Follow K-Pop Group Behind the Scenes!

    The promotional period stars March 14th and will last until April 14th, 2018 . From the second episode, you can watch only YouTube Red subscribers.
  • Third nor'easter in 2 weeks on the horizon

    Third nor'easter in 2 weeks on the horizon

    More than 1,000 flights were canceled Tuesday, a lot of them at Boston Logan International Airport, according to FlightAware. As the evening hours rolled around, snow accumulations averaged 18 to 24 inches from near Rome to Clayton.

    Featured Stock: Merck & Co., Inc. (NYSE:MRK)

    The 50-day moving average is perceived to be the dividing line between a stock that is technically healthy and one that is not. If a buyer buys one share of stock from a seller, then that one share is added to the total volume of that particular stock.
    WTA INDIAN WELLS - Venus, Halep and Pliskova march to the quarters

    WTA INDIAN WELLS - Venus, Halep and Pliskova march to the quarters

    After recently taking back the world No. 1 ranking from Caroline Wozniacki, Halep is off to a fantastic start at the tournament. "In the beginning it was really tough because I was really nervous going on the big stages against big players", she said.


Latest news

Toyota teases redesigned 2019 RAV4 crossover ahead of NY debut
The RAV4 is Toyota's best-selling nameplate right now, so the new model's reveal is a huge deal for the Japanese automaker. It has also formed the foundations for the all-new Corolla which was revealed at the Geneva show, now underway.

QUALCOMM Incorporated (QCOM) projected to achieve -56.50% earnings growth for this year
Maverick Capital Ltd. acquired a new stake in shares of QUALCOMM in the second quarter valued at approximately $210,548,000. It has underperformed by 12.18% the S&P500. (NVDA) by 24.57% based on its latest 2017Q3 regulatory filing with the SEC.

Pi Day 2018: Google Doodle celebrates 30th anniversary of the mathematical holiday
It was also independently determined by Chinese mathematician Zu Chongzhi (429-501), who computed pi to six decimal places. While Pi can continue into infinity without repetition or pattern, only a few digits are necessary for typical equations.

Federer moves on, Stephens loses again at Indian Wells
The match was suspended due to rain at 2230 local time poised with the second set tied at 2-2, and no further play was possible. Seventh seed Kevin Anderson took down Nicolas Kicker 7-6 (1) 7-6 (3) and South Korea's Chung Hyeon beat Tomas Berdych 6-4 6-4.

PH withdraws from Rome Statute
In February, the ICC launched a preliminary inquiry into allegations of crimes against humanity committed by Duterte. The Philippines signed the Rome Statute of the ICC in 2000 and ratified it in 2011, becoming its 117th State Party.

My oh my, what a Pi Day for dining deals
Cicis: The pizza-buffet chain is offering a buy one adult buffet, get a second buffet for $3.14 on March 14 only. Kroger: 8-inch bakery pies will be available for $3.14 (with a Kroger card) on Tuesday and Wednesday.

Roger Federer Breezes Past Filip Krajinovic at the 2018 Indian Wells Masters
Roger Federer , of Switzerland, returns a shot against Jack Sock during an exhibition tennis match in San Jose, California. It is still early stages for Novak coming back and the first one after surgery.

Global Automotive Thermostat Market Attractiveness, Competitive Landscape and Key Players
Production market shares and sales market shares are analysed along with the study of capacity, production, sales, and revenue. The report analyzes Automotive Electric Water Pump necessary driving forces trailing the growth of the market in detail.

Corporate Office Properties Trust (OFC) to Issue $0.28 Quarterly Dividend
Louisiana State Employees Retirement Sys stated it has 0.06% in Medical Properties Trust, Inc. (NYSE:NKE) for 71,236 shares. Several other hedge funds and other institutional investors have also recently modified their holdings of OFC .

Trump's Rick Saccone Has Really Upset Steel Workers in Pennsylvania
Saccone said late Tuesday night that there are also provisional and military absentee ballots that still need to be counted. Republicans are hoping to prevent the district that Donald Trump won handily from falling into Democratic hands.

Shoe thrown at Imran Khan during PTI rally in Gujarat
Following the incident, the attacker was detained by the seminary's administration and later handed over to the police. The shoe attack drew widespread commendations from politicians and civil society.

Trump sends message: U.S. tech not for sale
Two analysts said Xilinx and Mellanox would be a good fit for Broadcom, though not as transformational as Qualcomm. But unlike with its steel tariffs, the Administration's national-security concerns in this case are legitimate.

'Fantastic Beasts: The Crimes of Grindelwald' trailer takes Potterheads back to Hogwarts
The story clearly follows Newt Scamander and his entertaining and easily startled pal along another adventure, this time in Paris. These movies are set before the time of Potter and therefore should be held on a completely different scale and not compared.

Senators divided on Trump's fired secretary of state
Lawmakers from both major parties have criticized those cuts and the administration's failure to fill dozens of open jobs there. The most awkward moment came in October 2017 when it was reported that Tillerson called the president "a moron" in a meeting.

Haryana college teacher shot dead by student
The student reportedly held a grudge against the principal after she scolded him for poor performance in studies. The government college is located in village Pipli of Kharkhoda, Sonipat district where the incident took place.

Other news