AMD won't patch all chips affected by severe data theft vulnerability — older Ryzen models will not get patched for 'Sinkclose' [Updated]

News
By
Published

AMD says some chips fall outside of the software support window.

AMD Ryzen 5 9600X
(Image credit: Tom's Hardware)
39

Edit 8/12/2024 4:45am PT: The researchers who discovered the flaw in AMD's chips contend that the vulnerability impacts all AMD chips extending back to 2006. However, AMD has not listed Ryzen and Threadripper 1000 and 2000 and other previously released products as impacted by the vulnerability. We are following up for further details regarding the disparity. 

AMD processors dating back to 2006, reportedly numbering in the hundreds of millions of chips, suffer from a major security flaw that allows attackers to infiltrate a system virtually undetectable. AMD Product Security has since released updates for several processor families to mitigate this issue, but not all of them will be covered. According to a statement given to Tom's Hardware, AMD said, "There are some older products that are outside our software support window." AMD has no plans to update its older Ryzen 3000 series processors, and it is possible that the vulnerability extends back further than the processors listed in AMD's advisory. We're following up for more details.

Latest Videos FromTom's Hardware
Jowi Morales
Jowi Morales
Contributing Writer

Jowi Morales is a tech enthusiast with years of experience working in the industry. He’s been writing with several tech publications since 2021, where he’s been interested in tech hardware and consumer electronics.

39 Comments Comment from the forums
  • -Fran-
    "AMD processors dating back to 2006 reportedly suffer from a major security flaw that allows attackers to infiltrate a system virtually undetectable."

    "Attackers need to access the system kernel to exploit the Sinkclose vulnerability"

    If you already have access to the Kernel, this exploit is kind of a nothing-burger.

    /facepalm

    Regards...?
    Reply
  • CelicaGT
    While I'm personally no expert on these particular matters, it has been made clear to me by someone who is, that this is of little consequence for the home user as it requires an extremely complex, targeted attack. No one is going to be collateral damage and this is the main reason AMD isn't too concerned with patching older, consumer level machines. For us, the risk is basically nil.
    Reply
  • Li Ken-un
    -Fran- said:
    If you already have access to the Kernel, this exploit is kind of a nothing-burger.
    I’d imagine this includes scenarios like booting into a USB stick. The OS on the USB stick is compromised, and either you had to turn secure boot off to use it (e.g., Ventoy) or the compromise did not affect secure boot verification. In either case, you’d have a deeply buried rootkit and your main installed OS wasn’t involved at all. All that had to be done was to boot your computer with an already prepared vector of infection.
    Reply
  • Gururu
    Nothing wrong with believing it is a true vulnerability from a homeland security perspective. If I had an AMD though, I wouldn't worry about it much since the dark web already has my social security LOL c/o the banking, credit and healthcare industries.
    Reply
  • Amdlova
    amd ryzen 1xxx 2xxx are so problematic amd try hard to hidden these cpus.
    Amd don't want patch these cpus because all the epyc cpus out there. Amd want piles of e-waste
    Reply
  • tamalero
    Li Ken-un said:
    I’d imagine this includes scenarios like booting into a USB stick. The OS on the USB stick is compromised, and either you had to turn secure boot off to use it (e.g., Ventoy) or the compromise did not affect secure boot verification. In either case, you’d have a deeply buried rootkit and your main installed OS wasn’t involved at all. All that had to be done was to boot your computer with an already prepared vector of infection.
    That still need someone to have access to your system in the first place. And to have credentials to boot it and have time to do all the things you mentioned.
    Reply
  • Makaveli
    Amdlova said:
    amd ryzen 1xxx 2xxx are so problematic amd try hard to hidden these cpus.
    Amd don't want patch these cpus because all the epyc cpus out there. Amd want piles of e-waste
    Don't know if that is it.

    Most enterprise would be on support contracts with their server\workstations. And those machine are old enough that they would have been swapped out for something newer years ago. Alot of companies will do a hardware refresh at like 3-5 years depending on contract.
    Reply
  • rluker5
    -Fran- said:
    "AMD processors dating back to 2006 reportedly suffer from a major security flaw that allows attackers to infiltrate a system virtually undetectable."

    "Attackers need to access the system kernel to exploit the Sinkclose vulnerability"

    If you already have access to the Kernel, this exploit is kind of a nothing-burger.

    /facepalm

    Regards...?
    Drivers often have access to the kernel.
    Videocardz could infect the masses. Well at least whoever gets updated drivers from there.
    At least Windows prompts you before you install something.
    Reply
  • spongiemaster
    -Fran- said:
    "AMD processors dating back to 2006 reportedly suffer from a major security flaw that allows attackers to infiltrate a system virtually undetectable."

    "Attackers need to access the system kernel to exploit the Sinkclose vulnerability"

    If you already have access to the Kernel, this exploit is kind of a nothing-burger.

    /facepalm

    Regards...?
    2nd hand market. Early generation Zen CPU's you're 99.99% likely to be buying them used. Do you know where that system has been?
    Reply
  • SonoraTechnical
    Really disappointed in Tom's Hardware on this one... It's a sensationalistic headline for generating clicks. You are overstating a threat that's actually never been implemented.

    Keep this kind of reporting up and I'll just get my news elsewhere.
    Reply