Not sure how easy to exploit this is, but still a pretty serious bug/backdoor. And it has been around for almost 20 years. I also wonder if the Windows OS could somehow tackle such an exploit?
Yesterday on an infosec video call, it was revealed that to exploit this vulnerability, a previous successful attack on the operating system and its kernel must have taken place. Attackers need to obtain permissions for the ring 0. The malware is executed in the system management mode and thus in the ring -2 and below the ring 0. AMD stresses that extensive access is necessary. MS should be able to tackle this exploit due to the way their OS is structured - though no specifics given at the time.
This is a standard that for this kind of vulnerability, so this only needed to be confirmed rather than "revealed". However each major operating system like macOS, Windows, or Linux has countless not-yet-publicly known vulnerabilities allowing to bypass into kernel-mode... And they are quite cheap to buy given that major exploit buyer gave only like $30k per such Windows exploit a year or two ago and even temporarirly stopped buying them even at that price. You can fix one such vulnerability, but countless will remain. Especially if you use Windows using non-SUA account.
AMD issued updates today for some of their EPYC and Ryzen microprocessors. There is a list of systems receiving updates on the AMD website.
Here is AMDs advisory: https://www.amd.com/en/resources/product-security/bulletin/amd-sb-7014.html Note that only server hardware gets separate microcode updates. Consumer/client hardware(includes business) only gets a PI update. Then you have to wait for the manufacturer to integrate and release it as a BIOS/UEFI update. If you're lucky enough to get one.. Exactly.
I assume malware most likely needs to load/install a driver in order to get full kernel access. So perhaps Windows could harden PatchGuard to restrict drivers even more. You're probably talking about a browser exploit that can use a Windows OS exploit to break the sandbox and get into admin-mode? I'm not sure if this enough to be able to abuse this AMD CPU bug though.
AMD reverses course: Ryzen 3000 CPUs will get SinkClose patch after all https://www.theregister.com/2024/08/20/amd_sinkclose_ryzen_3000/ While I'm not a fan of Intel, at least they provide longer support.
GIGABYTE's Latest AGESA BIOS Fixes Sinkclose Vulnerability of AMD Desktop Processors Aug 23, 2024 https://www.gigabyte.com/Press/News/2212 ---------- The F67c released yesterday = https://www.gigabyte.com/Motherboard/B450M-DS3H-V2-rev-1x/support#support-dl-bios
