AMD is researching a report that was published yesterday by an Israeli security company, which reveals the existence of 13 vulnerabilities affecting AMD Ryzen and EPYC processors.
The 13 gaps are organized into four vulnerability categories named RyzenFall, MasterKey, Fallout, and Chimera. CTS Labs, the security company that discovered these flaws, claims it can give attackers full control over a system and allow them to exfiltrate data from secure CPU regions, essentially what the Meltdown and Spectre vulnerabilities do. CTS Labs claims it discovered the flaws when it analyzed a modern AMD CPU and saw problematic code it had previously found in the old ASMedia firmware. This sparked the interest of the research team that later disclosed the 13 security bugs.
These AMD processors are developed for desktop computers, laptops, smartphones and servers. CTS Labs claims it has notified AMD, Microsoft and some other manufacturers to start the process of creating updated releases promptly.
From the discussion side on forums, users are quite dissatisfied with the company's (CTS Labs) decision to give AMD only one day deadline before publishing this data to address the flaws and with the fact that they did not share any detailed technical report to prove the validity of their research. Moreover, some experts noted that the company overestimates these vulnerabilities, which require administrator-level access and specialized knowledge for their successful exploitation.
Some patch is not available at the moment, as AMD continues to investigate the report and has not yet confirmed that the disclosure contains valid findings.
Detailed report of CTS Labs on the following site:
https://safefirmware.com/amdflaws_whitepaper.pdf
