Vulnerabilities in Ryzen processors allow hackers to "remotely" kill a computer

Cybersecurity specialists from the Israeli company CTS Labs warn of new critical vulnerabilities in AMD processors. This time, "holes" were found in processors on the architecture of Zen: EPYC, Ryzen, Ryzen Pro and Ryzen Mobile.

What is known

Discovered vulnerabilities give hackers access to confidential information. What's most unpleasant, intruders can remotely disable the computer by repeatedly overwriting the BIOS. Vulnerable were the chipsets, which provide the interaction of the CPU with other devices.

Types of vulnerabilities

This time AMD surpassed itself and missed four types of vulnerabilities, which were nicknamed Ryzenfall, Fallout, Masterkey and Chimera. They attack the subsystem AMD Secure Processor, which must monitor the "suspicious" processes and take appropriate actions.

A vulnerability like Ryzenfall takes control of AMD Secure Processor, and reads or writes to protected memory areas. Nothing prevents the hacker from running the code and stealing passwords. Ryzenfall are susceptible processors Ryzen, Ryzen Pro and Ryzen Mobile.

Masterkey works also, and it is subject to EPYC, Ryzen, Ryzen Pro and Ryzen Mobile. Vulnerability bypasses security checks and executes code in kernel mode with privileges. Masterkey replaces the BIOS chip with a modified one and launches a malicious code. Yes, to do this, you need physical contact with the equipment, and here Fallout comes into play.

Vulnerabilities of the Fallout type are affected by the server processors EPYC. It helps Masterkey steal personal information and perform a remote BIOS substitution, avoiding protection from flashing.

The leader of this trinity can be called the backdoor Chimera, which allows you to conduct a remote unauthorized entry. A hacker can run malware on a computer using USB, SATA, PCI-E, WiFi and Bluetooth.

Hidden threat

The exact number of "victims" is unknown. Due to vulnerabilities, AMD Secure Processor will not notify the user of the intrusion, and the actions of the hacker will go unnoticed. It is known that potentially vulnerable are machines running AMD chips.

Source: CTS Labs