AMD Chipset Vulnerability Leaks Passwords, Patch Available

AMD has divulged details about a chipset driver vulnerability that can allow non-privileged users to read and dump some types of memory pages in Windows. This technique allows an attacker to steal passwords or enable other types of attacks, including circumventing standard KASLR exploitation (aka Spectre and Meltdown) mitigations (via TheRecord).

Word of the bug came as part of a coordinated disclosure with Kyriakos Economou, a security researcher and co-founder of ZeroPeril, who exploited the vulnerability to download several gigabytes of sensitive data from impacted AMD platforms — but as a non-admin user. AMD has prepared mitigations that can be downloaded either as part of its latest chipset drivers or by using Windows Update to update the AMD PSP driver (details of how to update are below). 

AMD originally issued the patch several weeks ago, but without disclosing which vulnerabilities were addressed. This new disclosure answers those questions. 

How to Tell If You Have the Latest Drivers

If you're wondering whether you already have the mitigations in place to protect your PC, you need to check to see if your AMD PSP driver is version 5.17.0.0 or higher. To do that:

1. Open device manager. You can get there either by hitting Windows key + X and selecting it from the context menu.

Device manager

(Image credit: Tom's Hardware)

2. Open Security devices.

open security devices

(Image credit: Tom's Hardware)

3. Right click on AMD PSP Device and select properties.

select properties

(Image credit: Tom's Hardware)

4. Click the Driver tab.

click the driver tab

(Image credit: Tom's Hardware)

5. Look at the Driver Version number. If it's under 5.17.0.0 you need an update.

driver version number

(Image credit: Tom's Hardware)

How to Update Your AMD Chipset Drivers

If you have one of the CPUS above, you're running Windows  and your AMD PSP driver is lower than 5.17.0.0, follow these instructions.

1. Navigate to AMD's Drivers and Support Page.

2. Select the chipset for your motherboard from the menu and click Submit. For Ryzen processors, you'll want to start by picking Chipsets->AMD Socket AM4 and then the chipset (ex: B550).

Select the chipset

(Image credit: Tom's Hardware)

3. Click the Download button beneath "AMD Chipset Drivers." A zip file will download.

Click the download button

(Image credit: Tom's Hardware)

4. Open the zip file, extract the installer and run it. Be patient, because the software can take a few minutes to detect what you have and appear to be frozen. Don't click out of the window or, as per our experience, it may freeze.

5. Make sure AMD PSP Driver is checked and click Install.

Make sure AMD PSP driver is checked and click install

(Image credit: Tom's Hardware)

Again, you will need to be patient as the system will take several minutes downloading and installing updates.

AMD installing updates

(Image credit: Tom's Hardware)

6. Click Restart when the process is completed. 

Click Restart

(Image credit: Tom's Hardware)

Your computer will reboot and you should have the updated AMD PSP driver now.

Affected AMD Processors

  • 2nd Gen AMD Ryzen Mobile Processor with Radeon Graphics 
  • 2nd Gen AMD Ryzen Threadripper processor
  • 3rd Gen AMD Ryzen™ Threadripper™ Processors
  • 6th Generation AMD A series CPU with Radeon™ Graphics
  • 6th Generation AMD A-Series Mobile Processor  
  • 6th Generation AMD FX APU with Radeon™ R7 Graphics 
  • 7th Generation AMD A-Series APUs
  • 7th Generation AMD A-Series Mobile Processor  
  • 7th Generation AMD E-Series Mobile Processor
  • AMD A4-Series APU with Radeon Graphics 
  • AMD A6 APU with Radeon R5 Graphics
  • AMD A8 APU with Radeon R6 Graphics
  • AMD A10 APU with Radeon R6 Graphics
  • AMD 3000 Series Mobile Processors with Radeon™ Graphics 
  • AMD Athlon 3000 Series Mobile Processors with Radeon™ Graphics  
  • AMD Athlon Mobile Processors with Radeon™ Graphics 
  • AMD Athlon X4 Processor
  • AMD Athlon™ 3000 Series Mobile Processors with Radeon™ Graphics 
  • AMD Athlon™ X4 Processor
  • AMD E1-Series APU with Radeon Graphics
  • AMD Ryzen™ 1000 series Processor
  • AMD Ryzen™ 2000 series Desktop Processor
  • AMD Ryzen™ 2000 series Mobile Processor  
  • AMD Ryzen™ 3000 Series Desktop Processor
  • AMD Ryzen™ 3000 series Mobile Processor with  Radeon™ Graphics  
  • AMD Ryzen™ 3000 series Mobile Processor 
  • AMD Ryzen™ 4000 Series Desktop Processor with Radeon™ Graphics
  • AMD Ryzen™ 5000 Series Desktop Processor
  • AMD Ryzen™ 5000 Series Desktop Processor with Radeon™ Graphics 
  • AMD Ryzen™ 5000 Series Mobile Processors with Radeon™ Graphics
  • AMD Ryzen™ Threadripper™ PRO Processor
  • AMD Ryzen™ Threadripper™ Processor
TOPICS
Paul Alcorn
Editor-in-Chief

Paul Alcorn is the Editor-in-Chief for Tom's Hardware US. He also writes news and reviews on CPUs, storage, and enterprise hardware.

  • Wolfshadw
    Didn't see in the article where to check for your version of the AMD PSP Driver, so I found it under Device Manager --> Security Devices --> AMD PSP 3.0 Device.


    I'm running a Ryzen 5 2600 on a B450 chipset.

    -Wolf sends
    Reply
  • dehjomz
    Ouch. Glad they fixed the problem but that’s a pretty severe bug for admin access to be granted to a non-admin user. So much for Intel being the x86 vendor with security problems…
    Reply
  • Makaveli
    Seems THG is reporting this late?

    I'm already on this based on the previous chipset driver.


    They just released a newer version last week that has windows 11 support.

    version 3.09.01.140
    Reply
  • ezst036
    Linux unaffected?
    Reply
  • InvalidError
    dehjomz said:
    Ouch. Glad they fixed the problem but that’s a pretty severe bug for admin access to be granted to a non-admin user. So much for Intel being the x86 vendor with security problems…
    AMD likely has every bit as many security issues. Most of the flaws found in AMD CPUs were simply researchers checking whether AMD CPUs were vulnerable to the same or similar things Intel CPUs were after finding a new class of flaws on Intel chips, often finding out that ARM and other CPUs are also vulnerable to similar things.

    With AMD gaining more market share, you can expect more researchers to focus on AMD first and find more AMD-specific flaws.
    Reply
  • hotaru.hino
    dehjomz said:
    Ouch. Glad they fixed the problem but that’s a pretty severe bug for admin access to be granted to a non-admin user. So much for Intel being the x86 vendor with security problems…
    ezst036 said:
    Linux unaffected?
    This doesn't appear to be a hardware issue, just how the driver was implemented in Windows.
    Reply
  • Giroro
    I can't find AMD PSP in my device manager or my bios, is that bad?

    Running 3700X on a MSI x570 BIOS ver E7C37AMS.F10
    Reply
  • InvalidError
    Giroro said:
    I can't find AMD PSP in my device manager or my bios, is that bad?
    The PSP handles things like firmware-based TPM functions, you probably need to enable TPM or whatever alternative name it may have in BIOS.
    Reply
  • TheDane
    Can't find it. And TPM is enabled in BIOS.
    Reply
  • gdmaclew
    I followed all the instructions and it was successful

    Why, then, does my General Tab show no driver installed instead of This device is working properly?

    Granted I am running a one year old BIOS (1407).

    a/IAfcYWDView: https://imgur.com/a/IAfcYWD
    Reply