Here we are - 3600 which was still under manufacture 2-3 years ago are not get patched. Shame on you AMD, if it is true.

  • narc0tic_bird@lemm.ee
    link
    fedilink
    English
    arrow-up
    172
    ·
    2 months ago

    That’s so stupid, also because they have fixes for Zen and Zen 2 based Epyc CPUs available.

    Intel vs. AMD isn’t “bad guys” vs. “good guys”. Either company will take every opportunity to screw their customers over. Sure, “don’t buy Intel” holds true for 13th and 14th gen Core CPUs specifically, but other than that it’s more of a pick your poison.

    • haui@lemmy.giftedmc.com
      link
      fedilink
      English
      arrow-up
      64
      ·
      2 months ago

      Tangent: If we started buying risc-v systems we might get to a point where they can actually compete.

      • PrivateNoob@sopuli.xyz
        link
        fedilink
        English
        arrow-up
        47
        ·
        2 months ago

        That’s still far away from us as a consumer standpoint, but I’m eagerly waiting for a time when I could buy a RISC V laptop with atleast midrange computing capabalities

        • haui@lemmy.giftedmc.com
          link
          fedilink
          English
          arrow-up
          9
          ·
          2 months ago

          I‘m more on the builder/tinkerer side so I‘m pretty much in starting position with risc-v now. But yes, its going to be some time before any of it is user ready as a pc.

        • haui@lemmy.giftedmc.com
          link
          fedilink
          English
          arrow-up
          3
          ·
          2 months ago

          Yeah, thats the reason why we‘re in this capitalist hellhole. Perfection comes from billionaire money, nothing else.

            • haui@lemmy.giftedmc.com
              link
              fedilink
              English
              arrow-up
              1
              ·
              2 months ago

              I’m not buying hardware that doesn’t suit my needs as an investment hoping maybe it eventually will.

              You were misrepresenting things. Your needs have nothing to do with things not being functional. Something can be perfectly functional and not meet someones needs. Nobody said you should buy it as an investment.

              • conciselyverbose@sh.itjust.works
                link
                fedilink
                English
                arrow-up
                6
                ·
                2 months ago

                My interpretation was by far the most generous to your position, because it’s the only way it’s coherent.

                If people bought [this hardware that doesn’t actually provide anything anyone can realistically use at a reasonable price] it might eventually not suck. That’s treating a current purchase as an imaginary investment in maybe eventually being able to buy something useful.

                • haui@lemmy.giftedmc.com
                  link
                  fedilink
                  English
                  arrow-up
                  1
                  ·
                  2 months ago

                  My interpretation was by far the most generous to your position, because it’s the only way it’s coherent.

                  You’re entitled to your opinion, I guess.

                  hardware that doesn’t actually provide anything anyone can realistically use

                  Thats misrepresenting reality and making assumptions while clearly showing lack of expertise

                  at a reasonable price

                  Thats completely arbitrary. If a price is reasonable or not depends on many factors. Obvious oversymplification.

                  That’s treating a current purchase as an imaginary investment in maybe eventually being able to buy something useful.

                  This shows that you have no idea what you are talking about. Small companies and open source projects depend on people buying their products instead of cheaper, sometimes better performing products of big conglomerates for other reasons than price alone.

        • Amanda@aggregatet.org
          link
          fedilink
          English
          arrow-up
          3
          ·
          2 months ago

          This is one of the hardest earned lessons I’ve ever learned, and I’ve had to learn it over and over again. I think it’s mostly stuck now but I still make the same mistake from time to time.

      • narc0tic_bird@lemm.ee
        link
        fedilink
        English
        arrow-up
        6
        ·
        2 months ago

        I’m waiting to see how DeepComputing’s RISC-V mainboard for the Framework turns out. I’m aware that this is very much a development platform and far from an actual end-user product, but if the price is right, I might jump in to experiment.

    • Victor@lemmy.world
      link
      fedilink
      English
      arrow-up
      8
      ·
      2 months ago

      How is AMD “screwing us over”? Surely they aren’t doing this on purpose? That seems very cynical.

      • Grippler@feddit.dk
        link
        fedilink
        English
        arrow-up
        68
        ·
        edit-2
        2 months ago

        They are 100% not patching old chips intentionally by not allocating resources to it. It’s a conscious choice made by the company, it is very much “on purpose”.

        • Victor@lemmy.world
          link
          fedilink
          English
          arrow-up
          15
          ·
          2 months ago

          That’s not what I was referring to. I was referring to the act of “adding vulnerabilities”. Surely they aren’t doing that on purpose. And surely they would add fixes for it if it was economically viable? It’s a matter of goodwill and reputation, right?

          I don’t know, I just don’t think it’s AMD’s business model to “screw over” their customers. I just don’t.

          • narc0tic_bird@lemm.ee
            link
            fedilink
            English
            arrow-up
            26
            ·
            2 months ago

            What I mean by that is that they will take a huge disservice to their customers over a slight financial inconvenience (packaging and validating an existing fix for different CPU series with the same architecture).

            I don’t classify fixing critical vulnerabilities from products as recent as the last decade as “goodwill”, that’s just what I’d expect to receive as a customer: a working product with no known vulnerabilities left open. I could’ve bought a Ryzen 3000 CPU (maybe as part of cheap office PCs or whatever) a few days ago, only to now know they have this severe vulnerability with the label WONTFIX on it. And even if I bought it 5 years ago: a fix exists, port it over!

            I know some people say it’s not that critical of a bug because an attacker needs kernel access, but it’s a convenient part of a vulnerability chain for an attacker that once exploited is almost impossible to detect and remove.

            • Jakeroxs@sh.itjust.works
              link
              fedilink
              English
              arrow-up
              1
              ·
              2 months ago

              Maybe they’ll reverse course with enough blowback, they did that once with ryzen already, don’t remember which Gen it was but it wasn’t going to be backwards compatible with certain type of mobos, but then they released it anyway and some mobo manufacturers did provide bios updates to support it.

              Similarish situation could happen here, the biggest hangup I’d think is that the 3000 series is nearly 5 years old, and getting mobo manufacturers on board for that could be difficult.

            • Victor@lemmy.world
              link
              fedilink
              English
              arrow-up
              1
              ·
              edit-2
              2 months ago

              Well, you feel how you feel, and you choose the products you want after this. Good luck to you! 👍

              Edit: So many down votes for wishing someone good luck. The hive mind is odd sometimes.

          • Grippler@feddit.dk
            link
            fedilink
            English
            arrow-up
            16
            ·
            2 months ago

            No they are just choosing not to roll out the fix to a known issue, which is screwing customers over on purpose (to increase profits). It’s not a matter of goodwill, they sold a product that then turned out to have a massive security flaw, and now they don’t want to fix even though they absolutely could.

            • Victor@lemmy.world
              link
              fedilink
              English
              arrow-up
              2
              ·
              2 months ago

              I’m guessing it’s a balance between old products, effort, severity, etc. As we’ve learned, this is only an issue for an already infected system. 🤷‍♂️

              • Grippler@feddit.dk
                link
                fedilink
                English
                arrow-up
                7
                ·
                edit-2
                2 months ago

                Ryzen 3000 series CPUs are still sold as new, I even bought one six months ago, they’re no where near being classified as “old”, they’re hardly 5 years old. And this is not only an issue for already infected systems because uninfected systems will intentionally be left vulnerable.

                • Auli@lemmy.ca
                  link
                  fedilink
                  English
                  arrow-up
                  1
                  ·
                  2 months ago

                  Just because a store is still selling their stock doesn’t mean AND is still making them and selling them.

                • Victor@lemmy.world
                  link
                  fedilink
                  English
                  arrow-up
                  1
                  ·
                  2 months ago

                  Ryzen 3000 series CPUs are still sold as new

                  Ah, that changes things. Not great. But still,

                  uninfected systems will intentionally be left vulnerable

                  what I meant was that apparently only compromised systems are vulnerable to this defect.

          • ShortN0te@lemmy.ml
            link
            fedilink
            English
            arrow-up
            14
            ·
            2 months ago

            No, but those vulnerabilities where there when you bought it.

            Would a car have a defect that was shown 5 years later, then the manufacturer would have to recall it or offer a repair program and or money in exchange.

            Since everything is proprietary you cannot even fix things like this by yourself. The manufacturer needs to be held liable.

            • Victor@lemmy.world
              link
              fedilink
              English
              arrow-up
              3
              ·
              2 months ago

              Would a car have a defect that was shown 5 years later, then the manufacturer would have to recall it or offer a repair program and or money in exchange.

              I mean… A car is different, depending on the defect. It’s like “this window only breaks if you’ve already crashed the car”. (The defect only causes a vulnerability if the system is already compromised AFAICT.) And 5 years is much, much younger for a car compared to a CPU, but that’s not the important bit, I know.

              But I agree with you all, I am not saying it shouldn’t be fixed, I was just saying I don’t think AMD is looking to screw over their customers on purpose. That’s all.

              • Norah - She/They@lemmy.blahaj.zone
                link
                fedilink
                English
                arrow-up
                5
                ·
                edit-2
                2 months ago

                “this window only breaks if you’ve already crashed the car”

                No, it’s usually more like “this thing will break and cause a car crash” or “this thing will murder everyone in the vehicle if you crash”. And companies still will not fix it. Look at the Ford Pinto, executives very literally wrote off people’s deaths as a cost of doing business, when they’d turn into fireballs during even low speed rear-end collisions. Potentially burning down the car that hit them too.

                Edit: I mean, just look at the Takata airbag recall. 100 million airbags from 20 different carmakers recalled because they wouldn’t activate during a crash.

                • Victor@lemmy.world
                  link
                  fedilink
                  English
                  arrow-up
                  2
                  ·
                  edit-2
                  2 months ago

                  When I said “It’s like”, I meant it as a simile to what’s going on with AMD right now. Not with what’s actually going on with car companies. Car companies are a whole different topic and discussion, of which I know nothing.

          • conciselyverbose@sh.itjust.works
            link
            fedilink
            English
            arrow-up
            12
            ·
            2 months ago

            The cost isn’t that high. They’re already doing it for a bunch of parallel systems.

            In a just world they’d be legally required to provide the fixes, or fully refund the entire platform cost. It’s not remotely ethical to allow this to exist unpatched anywhere, regardless of support life.

    • Decipher0771@lemmy.ca
      link
      fedilink
      English
      arrow-up
      7
      ·
      2 months ago

      “Both sides”

      “Vote third party!”

      Wtf seriously this isn’t the same thing remotely but the arguments used are.

  • punkfungus@sh.itjust.works
    link
    fedilink
    English
    arrow-up
    108
    ·
    2 months ago

    Really not good enough from AMD. I wonder if Intel wasn’t a complete dumpster fire right now if they would still cut off the fix at Zen 3 (I doubt it). There’s really no reason not to issue a fix for these other than they don’t want to pay the engineers for the time to do it, and they think it won’t cost them any reputational damage.

    I hate that every product and company sucks so hard these days.

    • kibiz0r@midwest.social
      link
      fedilink
      English
      arrow-up
      5
      ·
      2 months ago

      They did issue a fix: “Buy a new CPU please!”

      That’s why they don’t mind the reputation hit. If 1 person swears allegiance to Intel as a result but 2 people buy new AMD chips, they’re still ahead. And people will forget eventually. But AMD won’t forget the Q3 2024 sales figures.

      • ulterno@lemmy.kde.social
        link
        fedilink
        English
        arrow-up
        2
        ·
        edit-2
        2 months ago

        Well, guess who’s not buying next gen Ryzen?

        They are doing similar stuff with deliberately delaying Linux driver capabilities for Radeon 7xxx series, to make more GPUs die out faster, by overheating (zero RPM fan until 60°+).

  • blackstrat@lemmy.fwgx.uk
    link
    fedilink
    English
    arrow-up
    82
    ·
    2 months ago

    Attackers need to access the system kernel to exploit the Sinkclose vulnerability, so the system would have to already be compromised. The hack itself is a sophisticated vector that is usually only used by state-sponsored hackers, so most casual users should take that into account.

    So it’s a vulnerability that requires you to.already have been compromised. Hardly seems like news.

    I can understand AMD only patching server chips that by definition will be under greater threat. On the other hand it’s probably not worth the bad publicity not to fix more.

    • atiredittechnician@lemmy.world
      link
      fedilink
      English
      arrow-up
      31
      ·
      2 months ago

      The reason that this is news is because it allows malware to embed itself into the processor microcode once kernel is breached. IE: If it is exploited for compromise, you either have to have the knowledge and hardware to reset the processor microcode manually (Requires an SPI flash tool) or you toss the hardware entirely. There’s no just ‘blow the drive away and reinstall the OS’ solution available.

      • WhyJiffie@sh.itjust.works
        link
        fedilink
        English
        arrow-up
        18
        ·
        2 months ago

        This sounds weird. I was in the impression that operating systems load updated cpu microcode at every boot, because it does not survive a power cycle, and because the one embedded in the BIOS/UEFI firmware is very often outdated. But then how exactly can a virus persist itself for practically forever?

        • Norah - She/They@lemmy.blahaj.zone
          link
          fedilink
          English
          arrow-up
          5
          ·
          2 months ago

          The OS can’t get to the point of loading cpu microcode without that outdated, embedded microcode. The reason it can persist is because there aren’t a lot of good ways to see what that UEFI microcode actually is once it’s installed. Plus, only the UEFI tells you that it has successfully updated itself. There is no other more authoritative system to verify that against. So the virus could just lie and say it’s gone and you would never know. Hence needing to treat it as the worst case scenario, that it never leaves.

      • booly@sh.itjust.works
        link
        fedilink
        English
        arrow-up
        15
        ·
        2 months ago

        And that introduces a specific type of supply chain threat: someone who possesses a computer can infect their own computer, sell it or transfer it to the target, and then use the embedded microcode against the target, even if the target completely reformats and reinstalls a new OS from scratch.

        That’s not going to affect most people, but for certain types of high value targets they now need to make sure that the hardware they buy hasn’t already been infected in the supply chain.

    • PM_Your_Nudes_Please@lemmy.world
      link
      fedilink
      English
      arrow-up
      16
      ·
      2 months ago

      It’s important because it allows them to directly modify the CPU’s microcode. Basically, the CPU has its own set of instructions, called microcode, which controls how the chip functions on a physical level. If they manage to change your microcode, even a full system reformat won’t kill the virus; You’ll need to either re-flash the CPU (which is not something the standard user or even power user will know how to do) or replace the entire CPU.

    • Sethayy@sh.itjust.works
      link
      fedilink
      English
      arrow-up
      13
      ·
      2 months ago

      That being said it builds up vulnerabilities in anti-cheats to another beautiful crowstrike like domino cluster fuck

    • CaptPretentious@lemmy.world
      link
      fedilink
      English
      arrow-up
      2
      ·
      2 months ago

      I personally agree. I think it’s being somewhat overhyped. If step one is physical access to get things rolling… like for sure some machines are in more public areas than others. But for me, someone would have to break into my house first, then access my machine, just to run exploits later. The exploit is pretty massive, but I think needs to be tempered with “first they need physical access”. Because physically controlling machines has always been number 1 for security.

  • teawrecks@sopuli.xyz
    link
    fedilink
    English
    arrow-up
    66
    ·
    2 months ago

    I feel like this is the perfect place for Right to Repair legislation: the product is broken? And it’s outside your support window? Then give customers what they need to make the fix themselves. It’s not good enough to say “meh, guess you gotta buy one of our newer chips then 🤷”

      • Vilian@lemmy.ca
        link
        fedilink
        English
        arrow-up
        9
        ·
        2 months ago

        Yep, every intel or AMD CPU vulnerability get patched in the kernel before the official firmware patches

    • nlgranger@lemmy.world
      link
      fedilink
      English
      arrow-up
      14
      ·
      2 months ago

      Consumer usage is not really concerned by the attack scenario of this vulnerability from what I understand. The prerequisite is to have access to the bios so it’s already game over at this point.

      • PM_Your_Nudes_Please@lemmy.world
        link
        fedilink
        English
        arrow-up
        6
        ·
        2 months ago

        Sure, but that feels a little bit like saying “We don’t need guards inside the prison, because we already have them patrolling around the perimeter.”

      • WhyJiffie@sh.itjust.works
        link
        fedilink
        English
        arrow-up
        5
        ·
        2 months ago

        Chip makes should not only treat customer CPUs as possibly-business hardware when adding shit like (Intel) ME, Pluton and (AMD) PSP, but also when patching serious vulnerabilities and providing support!

        • hangonasecond@lemmy.world
          link
          fedilink
          English
          arrow-up
          3
          ·
          2 months ago

          When you pay for enterprise equipment, you are typically paying a premium for longer, more robust support. Consumer products are less expensive because they don’t get this support.

          • WhyJiffie@sh.itjust.works
            link
            fedilink
            English
            arrow-up
            1
            ·
            2 months ago

            But they are already pretending for whatever reason that these are suitable for enterprises, by always includingthe aformentioned remote control components!

        • nlgranger@lemmy.world
          link
          fedilink
          English
          arrow-up
          1
          ·
          2 months ago

          Agreed, firmware security by chip manufacturers has been underwhelming to say the least and we can blame them for that. But in this specific instance I still don’t see the benefit of a fix for consumer usage. Companies have a responsibility and accountability toward their users, so a fix is due, for personal laptops/PCs the threat is toward the owners themselves (activists, diplomats, journalists, etc.). The latter do not buy second hand equipment, and if the firmware is compromised while they own it, they are already in danger.

          • WhyJiffie@sh.itjust.works
            link
            fedilink
            English
            arrow-up
            1
            ·
            edit-2
            2 months ago

            The latter do not buy second hand equipment

            You are assuming activists are well funded in some way, and that they are not repressed.

            This obviously has a benefit for consumer usage too, same as encryption. You’re basically saying consumers don’t need any kind of antivirus either, because it’s not that critical.
            This vuln should have been fixed for consumer hardware too, because it basically permanently taints all hardware that is vulnerable to it. And what makes it so hard to release patches for consumer hardware, when patches were already made for the same generations of enterprise hardware? Basically the majority of the work has been done already

            • nlgranger@lemmy.world
              link
              fedilink
              English
              arrow-up
              1
              ·
              2 months ago

              I’m not saying this is a small issue and nothing should be done. I just noted that the issue is not as big as some other hardware-based vulnerabilities we encountered in the past. And every threat model calls for a corresponding counter-measure.

              You are assuming activists are well funded in some way, and that they are not repressed. I’m assuming they are repressed, which is why they have people that buy and configure their equipment and hand it to them so that it hasn’t been tampered with. If you cannot afford that your should use your computer as if it was compromised.

              You’re basically saying consumers don’t need any kind of antivirus either Where did I write that?

              And what makes it so hard to release patches for consumer hardware. AMD focusing on where its money’s at and OEM/motherboard manufacturers being cheap and lazy and not pushing forward updates when they have them.

    • PriorityMotif@lemmy.world
      link
      fedilink
      English
      arrow-up
      5
      ·
      2 months ago

      Any news on the “pro” line? They were installed on business PCs and had additional security features built in. For instance there is a 3600 pro model.

      • A_Random_Idiot@lemmy.world
        link
        fedilink
        English
        arrow-up
        34
        ·
        edit-2
        2 months ago

        I dont know.

        If I had my choice between a CPU that has a vulnerability that can only be exploited if the system is already compromised

        or a CPU that are full of oxidation cancer, or frying themselves and doing irreparable damage… Which the company is being excessively shady about concretely admitting to any RMA promises and wwill all eventually die in short order…

        I think I’m gonna go with the Ryzen and not leave leave my computer outside at defcon.

        • schizo@forum.uncomfortable.business
          link
          fedilink
          English
          arrow-up
          18
          ·
          2 months ago

          Sure but we’re talking about several generation old CPUs: nothing’s wrong with Intel’s 10/9/8th gen CPUs, which would be the contemporary ones to the Ryzen chips in question.

          • herrvogel@lemmy.world
            link
            fedilink
            English
            arrow-up
            4
            ·
            2 months ago

            How is that? Does risc-v have magical properties that make its designers infallible, or somehow make it possible to fix flaws in the physical design after the CPU has already been fabbed and sold?

            • WhyJiffie@sh.itjust.works
              link
              fedilink
              English
              arrow-up
              1
              ·
              2 months ago

              Because it does not set in stone that there can be only 2 companies producing compatible chips, which can be however bad until both of them does the same shit practices.

              So the short answer is by not stifling competition.

          • 486@lemmy.world
            link
            fedilink
            English
            arrow-up
            4
            ·
            2 months ago

            As much as I like RISC-V, it is kind of ironic to suggest RISC-V ist the solution to this. At least as it stands, because of RISC-V’s simplicity, most if not all current RISC-V CPUs don’t even run microcode, so there is nothing to update/fix in case of a CPU bug. There’s even a very current example of this problem with that chinese RISC-V cpu that has this “GhostWrite” bug that allows every unpriviliged process to gain root access.

            • WhyJiffie@sh.itjust.works
              link
              fedilink
              English
              arrow-up
              2
              ·
              2 months ago

              As I said in an other reply, RISC-V is not the solution for the reason that they are perfect today. It is because it is not limited to being used by a few megacorporations that do whatever they want, but it allows competition where companies do what they need to become and remain a good choice.

              • 486@lemmy.world
                link
                fedilink
                English
                arrow-up
                1
                ·
                2 months ago

                I understood that. My point was rather that in this particular case (a CPU bug that could be fixed via microcode, but AMD chose not to do so for certain CPUs), RISC-V wouldn’t have been of any advantage, because there would be nothing to fix in the first place. Sure, one could introduce microcode for RISC-V and people have argued in favor of doing so for this exact reason, but the architecture was intentionally designed to not require microcode.