Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Zenbleed

lock.cmpxchg8b.com

Post reply on HN
Print view View original

21–30 of 378 posts

Re: Zenbleed

#21

Post by mrpippy »

deaddodo wrote: post #8
dtx1 wrote: post #2

> AMD have released an microcode update for affected processors. Your BIOS or Operating System vendor may already have an update available that includes it. Yes, I love flashing BIOS... edit nvm, Microcode can get updated via system updates.

Microcode updates haven't been managed in-BIOS for over a decade now. If you use Linux, you'll usually see them released as some package like "intel-microcode" or "amd-microcode". Even EFI updates rarely are very intrusive or dangerous, and can also be handled by the Operating System via an update.

They are managed both ways. I think updating in BIOS is preferable to ensure no CPU parameters change while (some part) of the kernel has already initialized.

But of course BIOS updates have many downsides and often stop after a few years.

Re: Zenbleed

#22

Post by lgl »

causi wrote: post #3

AMD Ryzen 5000 Series Processors with Radeon Graphics Does this mean Ryzen CPUs without integrated graphics are fine?

The only series 5000 cpu's that are still using Zen2 architecture are apparently the 5300U, 5500U and 5700U, which all use socket FP6 (mobile/embedded).

So I'm guessing it shouldn't affect any of the more recent and very popular Zen3 cpus like the 5600, 5700 etc. I personally own a 5600, which are a great bang for buck.

Re: Zenbleed

#25

Post by sounds »

ItsTotallyOn wrote: post #23

What does this allow the attacker to do? Steal data? The post isnt very clear.

Huh. The very first line seems pretty clear:

   > If you remove the first word from the string "hello world", what should
   > the result be? This is the story of how we discovered that the answer
   > could be your root password!
Can you please expand on your question?

Re: Zenbleed

#27

Post by neogodless »

kevin_thibedeau wrote: post #20
lopkeny12ko wrote: post #4

Relevant snippet: This technique is CVE-2023-20593 and it works on all Zen 2 class processors, which includes at least the following products: AMD Ryzen 3000 Series Processors AMD Ryzen PRO 3000 Series Processors AMD Ryzen Threadripper 3000 Series Processors AMD Ryzen 4000 Series Processors with Radeon Graphics AMD Ryzen PRO 4000 Series Processors AMD Ryzen 5000 Series Processors with Radeon Graphics AMD Ryzen 7020 S…

FYI, Ryzen 3000 APUs aren't Zen 2.

> AMD Ryzen 3000 Series Processors

The above are desktop. If they meant APUs, it would list "Ryzen 3000 Series Processors with Radeon Graphics."

Re: Zenbleed

#28

Post by timw4mail »

kevin_thibedeau wrote: post #20
lopkeny12ko wrote: post #4

Relevant snippet: This technique is CVE-2023-20593 and it works on all Zen 2 class processors, which includes at least the following products: AMD Ryzen 3000 Series Processors AMD Ryzen PRO 3000 Series Processors AMD Ryzen Threadripper 3000 Series Processors AMD Ryzen 4000 Series Processors with Radeon Graphics AMD Ryzen PRO 4000 Series Processors AMD Ryzen 5000 Series Processors with Radeon Graphics AMD Ryzen 7020 S…

FYI, Ryzen 3000 APUs aren't Zen 2.

They are Zen+, aren't they?

Re: Zenbleed

#29

Post by paulmd »

lgl wrote: post #22
causi wrote: post #3

AMD Ryzen 5000 Series Processors with Radeon Graphics Does this mean Ryzen CPUs without integrated graphics are fine?

The only series 5000 cpu's that are still using Zen2 architecture are apparently the 5300U, 5500U and 5700U, which all use socket FP6 (mobile/embedded). So I'm guessing it shouldn't affect any of the more recent and very popular Zen3 cpus like the 5600, 5700 etc. I personally own a 5600, which are a great bang for buck.

Lucienne (5700U/5500U/5300U) are the only Zen2s in the 5000 series at present (afaik), but AMD continues to re-use the Zen2 architecture in the 7000 series (7520U, etc), as well as many semicustom products like Steam Deck.

It's in rather a sweet-spot as far as performance-power-area, so this isn't entirely a bad thing. Zen3's main innovation was unifying the CCXs/caches, but if you only have a 4C, or you want to be able to power-gate a CCX (and its attendant IF links/caches) down entirely, Zen2 does that better, and it's slightly smaller. We'll be seeing Zen2 products for years to come, most likely.

Re: Zenbleed

#30

Post by yyyk »

Night_Thastus wrote: post #7
dtx1 wrote: post #2

> AMD have released an microcode update for affected processors. Your BIOS or Operating System vendor may already have an update available that includes it. Yes, I love flashing BIOS... edit nvm, Microcode can get updated via system updates.

To be fair, flashing the bios isn't nearly as bad on most modern systems. Put the file on a USB drive, plug it in, restart and go into the bios, look for the flashing utility, select the file, done. As long as the machine is on a UPS in case of disaster, everything's accounted for.

Often the BIOS will allow reading the update file from EFI partition, so there's no need for the USB drive.
Post reply on HN