AMD discloses slew of high severity security vulnerabilities that attacks BIOS chips on Zen systems — updates aren't available for all chips, finally a fix Zenbleed

News
By
Published

Update your BIOS ASAP.

AMD
(Image credit: AMD)
36

AMD has disclosed four vulnerabilities found in its Zen-based CPUs, ranging from the original Zen chips to the latest Zen 4 processors, and not all impacted chips have a readily available BIOS version to correct the issue. The vulnerabilities, which compromise the security of the SPI interface that connects to the flash chip that stores your BIOS, affect different generations of different Zen CPUs — not all processors are vulnerable to all four bugs. AMD is patching the vulnerabilities through new versions of AGESA, which is the base code for motherboard BIOSes. However, not all motherboard vendors have released new updates with the patched AGESA.

Though distinct, the four vulnerabilities hinge on the SPI interface that connects the CPU to the chip on the motherboard where the system firmware is stored. Exploiting these vulnerabilities could allow hackers to perform denial of service attacks, escalate privileges, and even execute arbitrary code. That last one can be particularly scary, as arbitrary code execution essentially means tricking a computer into running code, and that code could really be anything. However, any attack would require local access to the affected system, meaning that it would take an especially vigilant attacker to exploit the vulnerability. 

Latest Videos FromTom's Hardware
Matthew Connatser
Matthew Connatser

Matthew Connatser is a freelancing writer for Tom's Hardware US. He writes articles about CPUs, GPUs, SSDs, and computers in general.

36 Comments Comment from the forums
  • Are these the type of "vulnerabilities" where an attacker basically needs to already have access to your system to take advantage of them?

    If not, could someone more knowledgeable on this type of thing give an example scenario of how an unsuspecting user could fall victim to one of these vulnerabilities?
    Reply
  • FunSurfer
    ^ Yes, how exactly the hacker access the SPI interface that connects the CPU to the chip on the motherboard?
    Reply
  • Order 66
    HopefulToad said:
    Are these the type of "vulnerabilities" where an attacker basically needs to already have access to your system to take advantage of them?

    If not, could someone more knowledgeable on this type of thing give an example scenario of how an unsuspecting user could fall victim to one of these vulnerabilities?
    Good luck getting physical access to a system if it is at a user's house. I don't understand why these vulnerabilities even matter for most people with desktop PCs at work or home.
    Reply
  • AgentBirdnest
    HopefulToad said:
    Are these the type of "vulnerabilities" where an attacker basically needs to already have access to your system to take advantage of them?

    If not, could someone more knowledgeable on this type of thing give an example scenario of how an unsuspecting user could fall victim to one of these vulnerabilities?
    Wondering the same thing. I generally don't like to update my BIOS if I don't need to, so I'd like to know if I really should or not.
    Because if the hacker has to physically be sitting at my PC, here in my bedroom, then I've got much bigger problems to worry about than being hacked.
    Reply
  • Order 66
    AgentBirdnest said:
    Wondering the same thing. I generally don't like to update my BIOS if I don't need to, so I'd like to know if I really should or not.
    Because if the hacker has to physically be sitting at my PC, here in my bedroom, then I've got much bigger problems to worry about than being hacked.
    exactly my point. I don't really think about updating my bios very often, even though I probably should, now that you mention it.
    Reply
  • Makaveli
    Still waiting for AGESA version 1.2.0.C for my asus board which I thought they said was going to be released end of 2023 I guess not!

    FunSurfer said:
    ^ Yes, how exactly the hacker access the SPI interface that connects the CPU to the chip on the motherboard?
    Physical access?
    Reply
  • Notton
    I didn't see ryzen 4000 mobile on the list.
    Is the list incomplete, or is 4000 mobile somehow not affected?
    Reply
  • USAFRet
    Order 66 said:
    Good luck getting physical access to a system if it is at a user's house. I don't understand why these vulnerabilities even matter for most people with desktop PCs at work or home.
    Amazingly, there are LOTS of systems that exist in places other than your bedroom.

    Aircraft manufacturer offices, nighttime cleaning crew...
    Reply
  • Order 66
    USAFRet said:
    Amazingly, there are LOTS of systems that exist in places other than your bedroom.

    Aircraft manufacturer offices, nighttime cleaning crew...
    Which is why I said for most users with desktop PCs at home or work. I understand that there are systems that are vulnerable to this type of attack, but I was trying to make the point that for the vast majority of people who have their PCs at home, this is not a concern. You could make the argument that desktop PCs at the workplace are more vulnerable, I guess.
    Reply
  • USAFRet
    Order 66 said:
    Which is why I said for most users with desktop PCs at home or work. I understand that there are systems that are vulnerable to this type of attack, but I was trying to make the point that for the vast majority of people who have their PCs at home, this is not a concern. You could make the argument that desktop PCs at the workplace are more vulnerable, I guess.
    Right.
    For your system and my system at home, not really a concern.

    For other people, it IS a concern.

    Not everything revolves around you or the typical home user.
    Reply