AMD’s ‘SinkClose’ Flaw Affects Almost Every AMD CPU in Existence – Patches Are Being Released

Why Trust Tech Report

Tech Report is one of the oldest hardware, news, and tech review sites on the internet. We write helpful technology guides, unbiased product reviews, and report on the latest tech and crypto news. We maintain editorial independence and consider content quality and factual accuracy to be non-negotiable.

Looks like it isn’t just Intel that’s facing processor issues – a major vulnerability has been discovered in AMD processors, too. This issue has been affecting all models released by AMD since 2006.

It’s worth noting that Ryzen and EPYC series processors are included in this as well, which means millions of devices can be exposed to a ‘SinkClose’ attack.

The vulnerability was identified by security researchers Enrique Nissim and Krzysztof Okupski from IOActive. They shared details about it at the Defcon conference.

In fact, according to a report by Wired, the issue is believed to be so severe that in some cases it would be better to abandon the machine altogether than to try and repair it.

How Does It Work?

The vulnerability allows hackers to target the System Management Mode (SMM) of the AMD processor, which is a high-privilege area used for low-level system management functions.

To get started, the hacker will need to gain access to the system’s kernel. This isn’t easy, but certainly doable if the system has been previously compromised by some other attack.

Once the perpetrator has access, they can install bootkit malware, which is a special type of malware that antivirus tools can’t detect. It can live in the system for years on end by staying invisible – even reinstalling the operating system won’t get rid of them.

“The vulnerability is nearly impossible to fix in computers that aren’t configured correctly, which is the case for most systems. In properly configured systems, the vulnerability could lead to malware infections — known as bootkits — that are nearly impossible to detect.” – an IOActive statement

The only way to remove the malware is to open your computer, connect to a specific part of its memory using an SPI Flash programmer, scan the memory to find the malware, and then remove it.

What Happens Now?

AMD is aware of the vulnerability and has released software updates for several of its processor families, such as its EPYC processors, the latest Threadripper, some Ryzen processors, and its MI300A data center chips.

It’s good that the company has assured that there will be no impact on the processors’ performance because of the patches. However, we’ll only know for sure when some performance tests are run.

Here’s a list of all the AMD processors that have already received a patch or are soon expected to:

Also, note that there might be other processors as well that are not listed on AMD’s advisory, but that may be facing the same issue. They, too, won’t receive any support from the company.

The only silver lining here is that since the vulnerability hasn’t been discovered up until now, which is several years later, it probably hasn’t been exploited yet.

However, if a hacker is skilled enough and manages to figure out the process, the attack won’t be too difficult to execute because exploiting this vulnerability does not require direct access to the system.

Related: AMD suffers cyberattack, employee and customer data stolen