AMD patches high severity security flaw affecting Zen chips

The patch was released in mid-December. When you purchase through links on our site, we may earn an affiliate commission. Here’s how it works. Chipmaking giant AMD has confirmed it recently patched a high-severity vulnerability affecting its Zen 1 to Zen 4 CPUs. The company published a new security advisory, detailing the bug and its potential for exploitation, noting, “Researchers from Google have provided AMD with information on a potential vulnerability that, if successfully exploited, could lead to the loss of SEV-based protection of a confidential guest.".

SEV is short for Secure Encrypted Virtualization - a hardware-based security feature designed to enhance the confidentiality and integrity of virtual machines (VMs) running on AMD EPYC processors. It encrypts the memory of individual VMs using unique encryption keys, ensuring that neither the hypervisor nor other VMs can access their data. The vulnerability is tracked as CVE-2024-56161, and has a severity score of 7.2/10 (high). It is described as an improper signature verification flaw in AMD CPU ROM microcode patch loader, which could allow threat actors with local admin privileges to load malicious CPU microcode. As a result, the confidentiality and integrity of a confidential guest running under AMD SEV-SNP would be lost.

“AMD has made available a mitigation for this issue which requires updating microcode on all impacted platforms to help prevent an attacker from loading malicious microcode,” the company concluded. “Additionally, an SEV firmware update is required for some platforms to support SEV-SNP attestation. Updating the system BIOS image and rebooting the platform will enable attestation of the mitigation. A confidential guest can verify the mitigation has been enabled on the target platform through the SEV-SNP attestation report.”.

The company only publicly disclosed the flaw recently, but the patch was actually released in mid-December 2024. AMD decided to delay the announcement to give its customers enough time to mitigate the problem. Sign up to the TechRadar Pro newsletter to get all the top news, opinion, features and guidance your business needs to succeed!. Sead is a seasoned freelance journalist based in Sarajevo, Bosnia and Herzegovina. He writes about IT (cloud, IoT, 5G, VPN) and cybersecurity (ransomware, data breaches, laws and regulations). In his career, spanning more than a decade, he’s written for numerous media outlets, including Al Jazeera Balkans. He’s also held several modules on content writing for Represent Communications.