AMD Revealed 31 Vulnerabilities Within Its Processor Lines, Ryzen & EPYC CPUs Included

AMD revealed in the most recent January update that thirty-one new vulnerabilities were found in its processors, covering Ryzen and EPYC CPUs.

The company has created numerous mitigations to alleviate the exposed processors and has also disclosed a report from the company in cooperation with teams from three top companies — Apple, Google, and Oracle. The company also announced several AGESA variants listed in the update (AGESA code is found when building the system's BIOS and UEFI code).

Due to the vulnerability's nature, the AGESA changes have been delivered to OEMs, and any patching will depend on each vendor to release it as soon as possible. It would be wise for consumers to visit the vendor's official website to find out if there is a new update waiting for download rather than waiting for the company to roll it out later.

AMD Processors vulnerable to this new attack include Ryzen models for desktops, HEDT, Pro, and mobile CPU series. There is a single vulnerability labeled as "high severity," while two others are less extreme but still important to patch. All exposures are attacked through the BIOS and ASP bootloader (also known as the AMD Secure Processor bootloader).

AMD CPU series that are vulnerable are:

Twenty-eight AMD vulnerabilities have been discovered affecting EPYC processors, with four models labeled with a "high severity" by the company. The three of high severity can have arbitrary code that can be executed through attack vectors in numerous areas. Also, one of the three listed has an additional exploit that permits writing data to specific sections leading to data loss. Other research teams found another fifteen vulnerabilities with lower severity and nine with minor severity.

Because of the large number of affected processors exploited, the company chose to disclose this recent vulnerability list that would typically be published in May and November each year and make sure that mitigations were prepared for release. Other vulnerabilities within AMD products include a variant of Hertzbleed, another that acts similarly to the Meltdown exploit, and one called "Take A Way."

DESKTOP

HIGH END DESKTOP

WORKSTATION

MOBILE - AMD Athlon Series

MOBILE - AMD Ryzen Series

News Sources: Tom's Hardware, AMD Client Vulnerabilities – January 2023, AMD Server Vulnerabilities – January 2023