AMD has confirmed it recently patched a high-severity vulnerability concerning chips dating back to 2017. Though the update was released a couple of months ago, the brand has just disclosed it to leave time for everyone to install it.
Tracked as CVE-2024-56161, this vulnerability could lead to the loss of SEV-based protection of a confidential guest. SEV (Secure Encrypted Virtualization) is a technology developed by AMD which enhances the security of virtual machines by encrypting their memory. This is especially important in confidential computing, where sensitive workloads run in untrusted environments such as public clouds. SEV uses one key per virtual machine to isolate guests and the hypervisor from one another.
AMD indicates that improper signature verification in its CPU ROM microcode patch loader may allow an attacker with local administrator privilege to load malicious CPU microcode. This results in integrity loss of confidential guests running under AMD SEV-SNP. Due to this, AMD netted it a 7.2 (High) CVSS severity rating.
According to AMD, this vulnerability affects chips from Zen 1 to Zen 4. These include AMD Epyc Naples 7001 series, Rome 7002 series, Milan 7003 series, Milan-X 7003 series, Genoa 9004 series, Genoa-X 9004 series, and Bergamo/Siena 9004 series.
The vulnerability was initially discovered by researchers from Google and got patched by AMD back in December 2024. The brand didn’t disclose its existence until now to leave enough time for cloud and datacentre providers to apply the patch.
Note that this vulnerability concerns data centre machines, so desktop users should be fine. It goes to show how nothing is secure indefinitely and how security bounties are worth their cost. After all, it’s just a drop in AMD’s 12.57 billion dollars of datacentre net revenue in 2024, which is up 94% from 2023.
AMD’s Epyc processors offer professionals a great high-performance platform at competitive prices. By being on the lookout for potential flaws, the brand proves that its aggressive pricing doesn’t affect security.
