Atti Abderrahim
Table of Contents
AMD Processor In recent discussions about processor vulnerabilities, much of the attention has focused on stability issues with Intel’s 13th and 14th generation Core processors. However, a newly highlighted vulnerability, named SinkClose, is drawing significant concern due to its potential impact on a vast array of AMD processors some of which date back nearly 20 years. While AMD processors are typically praised for their stability, this long-standing vulnerability raises questions about the security of older and even some modern AMD chips.
The Discovery of SinkClose
SinkClose, a vulnerability that has apparently existed for almost two decades, was brought to the public’s attention during the recent DEF CON security conference held from August 8 to 11, 2024, in Las Vegas. Security researchers Enrique Nissim and Krzysztof Okupski from the consulting firm IOActive presented their findings, revealing that the flaw exists in a critical component used to secure the System Management Mode (SMM) on AMD processors. SMM is one of the most powerful execution modes in the x86 architecture, with code that remains invisible to both the hypervisor and operating system-level protections.
Nissim and Okupski’s research indicates that this flaw affects a broad range of AMD processors, with the oldest confirmed affected models dating back to 2006. However, the researchers suggest that the vulnerability could be even older, potentially affecting processors from earlier generations.
Affected Processors and AMD’s Response
In response to the discovery, AMD has updated its security bulletin to provide details on the affected processors. The list is extensive, covering multiple product lines, including:
- EPYC processors: 1st to 4th generations
- Threadripper PRO processors
- Ryzen Embedded processors: V1000, V2000, V3000 series
- Ryzen desktop processors: 3000, 4000, 5000, 7000, and 8000 series
- Ryzen Mobile processors: 3000, 4000, 5000, 7000 series
- Athlon processors: 3000 series
- AMD Instinct MI300A chips
Overall, the vulnerability affects dozens of different AMD processor models. Despite the wide range of affected chips, AMD has emphasized that SinkClose is not easy to exploit. To take advantage of the flaw, an attacker would need level 0 access to the target machines, including kernel-level permissions within the operating system.
The Complexity of Exploitation and Limited Fixes
The complexity required to exploit SinkClose is one reason AMD has provided only a partial solution to the issue. Given that the vulnerability has been around for 18 years without significant exploitation, AMD has chosen not to issue patches for all affected processors. This decision reflects the belief that the flaw’s difficulty to exploit may limit its impact. However, Nissim remains skeptical, arguing that “if the foundations are broken, the security of the entire system is compromised.”
While this reasoning may hold for older processors that are less likely to be targeted, the existence of the flaw in newer processors raises concerns about potential future exploits, especially as security research advances and the vulnerability becomes better understood.
What This Means for AMD Users
For users of affected AMD processors, the SinkClose vulnerability represents a potential risk, albeit one that is challenging for attackers to exploit. The fact that AMD has not provided fixes for all affected processors may be concerning, but it also underscores the difficulty of successfully executing an attack using this flaw.
However, for high-security environments, the presence of such a vulnerability—particularly in processors still in use today—might necessitate additional security measures, such as enhanced monitoring and the use of updated processors that have received patches from AMD.
Conclusion
SinkClose serves as a reminder that even processors known for their stability are not immune to long-standing vulnerabilities. The discovery of this flaw in such a wide range of AMD processors, some dating back nearly two decades, highlights the importance of ongoing security research and vigilance. While the complexity of exploiting SinkClose may limit its immediate impact, the potential for future exploitation should not be ignored. AMD users, especially those with critical security needs, should stay informed about developments related to this vulnerability and consider the potential risks when using affected processors.
This situation also emphasizes the need for continued support and updates from manufacturers to address vulnerabilities that, while difficult to exploit, could have significant consequences if left unpatched.
