Fosstodon

Benjamin Carr, Ph.D. 👨🏻‍💻🧬<a href="https://hachyderm.io/tags/AMD" class="mention hashtag" rel="nofollow noopener" target="_blank">#AMD</a> discloses slew of high severity <a href="https://hachyderm.io/tags/security" class="mention hashtag" rel="nofollow noopener" target="_blank">#security</a> <a href="https://hachyderm.io/tags/vulnerabilities" class="mention hashtag" rel="nofollow noopener" target="_blank">#vulnerabilities</a> for <a href="https://hachyderm.io/tags/Zen" class="mention hashtag" rel="nofollow noopener" target="_blank">#Zen</a> systems, from the original Zen chips to the latest <a href="https://hachyderm.io/tags/Zen4" class="mention hashtag" rel="nofollow noopener" target="_blank">#Zen4</a> <a href="https://hachyderm.io/tags/CPU" class="mention hashtag" rel="nofollow noopener" target="_blank">#CPU</a>, that attacks <a href="https://hachyderm.io/tags/BIOS" class="mention hashtag" rel="nofollow noopener" target="_blank">#BIOS</a> chips, we finally have a <a href="https://hachyderm.io/tags/Zenbleed" class="mention hashtag" rel="nofollow noopener" target="_blank">#Zenbleed</a> fix. AMD is patching the vulnerabilities through new versions of <a href="https://hachyderm.io/tags/AGESA" class="mention hashtag" rel="nofollow noopener" target="_blank">#AGESA</a>, for <a href="https://hachyderm.io/tags/Zen2" class="mention hashtag" rel="nofollow noopener" target="_blank">#Zen2</a>-based chips, in particular, many of these new AGESAs also patch Zenbleed, including <a href="https://hachyderm.io/tags/Epyc" class="mention hashtag" rel="nofollow noopener" target="_blank">#Epyc</a> <a href="https://hachyderm.io/tags/Server" class="mention hashtag" rel="nofollow noopener" target="_blank">#Server</a> chips <a href="https://bit.ly/3I1JKds" rel="nofollow noopener" translate="no" target="_blank">https://bit.ly/3I1JKds</a> <a href="https://www.tomshardware.com/pc-components/cpus/amd-discloses-slew-of-high-severity-security-vulnerabilities-for-zen-chips-that-attack-bios-chips-updates-aim-to-patch-bugs-finally-fix-zenbleed" rel="nofollow noopener" translate="no" target="_blank">https://www.tomshardware.com/pc-components/cpus/amd-discloses-slew-of-high-severity-security-vulnerabilities-for-zen-chips-that-attack-bios-chips-updates-aim-to-patch-bugs-finally-fix-zenbleed</a>

Elias GriffinCybersecurity Advisory: Lenovo and many other manufacturers have bumped the AMD Zen2 CPU patch due Jan 6th, the flaw dubbed Zenbleed, to another 5 months in some cases, unbelievable!<a href="https://support.lenovo.com/us/en/product_security/ps500571-amd-cross-process-information-leak" rel="nofollow noopener" translate="no" target="_blank">https://support.lenovo.com/us/en/product_security/ps500571-amd-cross-process-information-leak</a>If you are on FreeBSD I suggest you download either Freaky's Zenbleed Workaround here:<a href="https://gist.github.com/Freaky/2560975d3c94246b86f464b8be75c967" rel="nofollow noopener" translate="no" target="_blank">https://gist.github.com/Freaky/2560975d3c94246b86f464b8be75c967</a>Or my FreeBSD Security Suite here: <a href="https://quadhelion.dev/elias/harden-freebsd" rel="nofollow noopener" translate="no" target="_blank">https://quadhelion.dev/elias/harden-freebsd</a>OR<a href="https://github.com/wravoc/harden-freebsd" rel="nofollow noopener" translate="no" target="_blank">https://github.com/wravoc/harden-freebsd</a>Which includes an entire hardening suite and CPU vulnerability checker by Stéphane Lesimple which you can singly grab here:<a href="https://github.com/speed47/spectre-meltdown-checker" rel="nofollow noopener" translate="no" target="_blank">https://github.com/speed47/spectre-meltdown-checker</a><a href="https://infosec.space/tags/cybersecurity" class="mention hashtag" rel="nofollow noopener" target="_blank">#cybersecurity</a> <a href="https://infosec.space/tags/zenbleed" class="mention hashtag" rel="nofollow noopener" target="_blank">#zenbleed</a> <a href="https://infosec.space/tags/BSD" class="mention hashtag" rel="nofollow noopener" target="_blank">#BSD</a> <a href="https://infosec.space/tags/freebsd" class="mention hashtag" rel="nofollow noopener" target="_blank">#freebsd</a> <a href="https://infosec.space/tags/vulnerability" class="mention hashtag" rel="nofollow noopener" target="_blank">#vulnerability</a> <a href="https://infosec.space/tags/infosec" class="mention hashtag" rel="nofollow noopener" target="_blank">#infosec</a>

IT NewsThis Week in Security: 1Password, Polyglots, and Roundcube - This week we got news of a security incident at 1Password, and we’re certain we ar... - <a href="https://hackaday.com/2023/10/27/this-week-in-security-1password-polyglots-and-roundcube/" rel="nofollow noopener" translate="no" target="_blank">https://hackaday.com/2023/10/27/this-week-in-security-1password-polyglots-and-roundcube/</a> <a href="https://schleuss.online/tags/hackadaycolumns" class="mention hashtag" rel="nofollow noopener" target="_blank">#hackadaycolumns</a> <a href="https://schleuss.online/tags/securityhacks" class="mention hashtag" rel="nofollow noopener" target="_blank">#securityhacks</a> <a href="https://schleuss.online/tags/1password" class="mention hashtag" rel="nofollow noopener" target="_blank">#1password</a> <a href="https://schleuss.online/tags/roundcube" class="mention hashtag" rel="nofollow noopener" target="_blank">#roundcube</a> <a href="https://schleuss.online/tags/polyglot" class="mention hashtag" rel="nofollow noopener" target="_blank">#polyglot</a> <a href="https://schleuss.online/tags/zenbleed" class="mention hashtag" rel="nofollow noopener" target="_blank">#zenbleed</a> <a href="https://schleuss.online/tags/news" class="mention hashtag" rel="nofollow noopener" target="_blank">#news</a>

DarkCyberman<a href="https://infosec.exchange/@merill" class="u-url mention" rel="nofollow noopener" target="_blank">@merill</a> I dislike the additional dependency on Microsoft managed infrastructure. Their track record isn’t great lately given <a href="https://nerdculture.de/tags/solarwinds" class="mention hashtag" rel="nofollow noopener" target="_blank">#solarwinds</a>, <a href="https://nerdculture.de/tags/bluebleed" class="mention hashtag" rel="nofollow noopener" target="_blank">#bluebleed</a> and their e-mail/key hack. I can’t even find a reasonable statement about <a href="https://nerdculture.de/tags/zenbleed" class="mention hashtag" rel="nofollow noopener" target="_blank">#zenbleed</a> for Azure.

Christian Blichmann🇺🇦Pretty good video to watch on the <a href="https://infosec.exchange/tags/zenbleed" class="mention hashtag" rel="nofollow noopener" target="_blank">#zenbleed</a> vulnerability, feat. Tacos Ormandy: <a href="https://youtu.be/neWc0H1k2Lc" rel="nofollow noopener" translate="no" target="_blank">https://youtu.be/neWc0H1k2Lc</a>

Melroy van den BergWhen looking at all the CPU vulnerabilities in the recent years even until this day. We see mitigations taking place in microcode or OS level. But the performance impact is huge! Sometimes 30%-50% decrease in performance on specific tasks like databases! Question: can we get some compensation as consumer? Since both Intel and AMD sold hardware that doesn't give the promised results. <a href="https://mastodon.melroy.org/tags/specre" class="mention hashtag" rel="nofollow noopener" target="_blank">#specre</a> <a href="https://mastodon.melroy.org/tags/meltdown" class="mention hashtag" rel="nofollow noopener" target="_blank">#meltdown</a> <a href="https://mastodon.melroy.org/tags/hertzbleed" class="mention hashtag" rel="nofollow noopener" target="_blank">#hertzbleed</a> <a href="https://mastodon.melroy.org/tags/Zenbleed" class="mention hashtag" rel="nofollow noopener" target="_blank">#Zenbleed</a> <a href="https://mastodon.melroy.org/tags/Inception" class="mention hashtag" rel="nofollow noopener" target="_blank">#Inception</a> <a href="https://mastodon.melroy.org/tags/vulnerability" class="mention hashtag" rel="nofollow noopener" target="_blank">#vulnerability</a> <a href="https://mastodon.melroy.org/tags/security" class="mention hashtag" rel="nofollow noopener" target="_blank">#security</a> <a href="https://mastodon.melroy.org/tags/secops" class="mention hashtag" rel="nofollow noopener" target="_blank">#secops</a> <a href="https://mastodon.melroy.org/tags/compensation" class="mention hashtag" rel="nofollow noopener" target="_blank">#compensation</a> <a href="https://mastodon.melroy.org/tags/money" class="mention hashtag" rel="nofollow noopener" target="_blank">#money</a>

lp0 on fire :unverified:The <a href="https://social.linux.pizza/tags/Linux" class="mention hashtag" rel="nofollow noopener" target="_blank">#Linux</a> kernel wants, for my CPU (Ryzen 3600), microcode revision 0x8701032. The latest available (only via BIOS updates, not linux-firmware) is 0x8701030, and the kernel complains about it:“Zenbleed: please update your microcode for the most optimal fix”<a href="https://social.linux.pizza/tags/AMD" class="mention hashtag" rel="nofollow noopener" target="_blank">#AMD</a> <a href="https://social.linux.pizza/tags/Ryzen" class="mention hashtag" rel="nofollow noopener" target="_blank">#Ryzen</a> <a href="https://social.linux.pizza/tags/Zenbleed" class="mention hashtag" rel="nofollow noopener" target="_blank">#Zenbleed</a>

Andrei G. :unverified:<a href="https://fosstodon.org/tags/Linux" class="mention hashtag" rel="tag">#Linux</a> added <a href="https://fosstodon.org/tags/Zenbleed" class="mention hashtag" rel="tag">#Zenbleed</a> fix for <a href="https://fosstodon.org/tags/SteamDeck" class="mention hashtag" rel="tag">#SteamDeck</a>.You'll ask yourself: what, wasn't this fixed last month? Yes, it was but not for the Steam Deck APU - the CPU model was missed in the Zenbleed erratum list. The fix is going to hit v6.5-rc6.<a href="https://www.phoronix.com/news/Linux-Zenbleed-Steam-Deck" target="_blank" rel="nofollow noopener" translate="no">https://www.phoronix.com/news/Linux-Zenbleed-Steam-Deck</a>

ricardo :mastodon:<a href="https://fosstodon.org/tags/Linux" class="mention hashtag" rel="tag">#Linux</a> Kernel Updated To Add <a href="https://fosstodon.org/tags/Zenbleed" class="mention hashtag" rel="tag">#Zenbleed</a> Fix For Valve's <a href="https://fosstodon.org/tags/SteamDeck" class="mention hashtag" rel="tag">#SteamDeck</a> :steamdeck: <a href="https://www.phoronix.com/news/Linux-Zenbleed-Steam-Deck" target="_blank" rel="nofollow noopener" translate="no">https://www.phoronix.com/news/Linux-Zenbleed-Steam-Deck</a>

Marcus "MajorLinux" SummersOoopsie!Linux Kernel Updated To Add Zenbleed Fix For Valve's Steam Deck - Phoronix <a href="https://www.phoronix.com/news/Linux-Zenbleed-Steam-Deck" rel="nofollow noopener" target="_blank">https://www.phoronix.com/news/Linux-Zenbleed-Steam-Deck</a><a href="https://toot.majorshouse.com/tags/Linux" class="mention hashtag" rel="nofollow noopener" target="_blank">#Linux</a> <a href="https://toot.majorshouse.com/tags/Kernel" class="mention hashtag" rel="nofollow noopener" target="_blank">#Kernel</a> <a href="https://toot.majorshouse.com/tags/Zenbleed" class="mention hashtag" rel="nofollow noopener" target="_blank">#Zenbleed</a> <a href="https://toot.majorshouse.com/tags/Fix" class="mention hashtag" rel="nofollow noopener" target="_blank">#Fix</a> <a href="https://toot.majorshouse.com/tags/Valve" class="mention hashtag" rel="nofollow noopener" target="_blank">#Valve</a> <a href="https://toot.majorshouse.com/tags/SteamDeck" class="mention hashtag" rel="nofollow noopener" target="_blank">#SteamDeck</a> <a href="https://toot.majorshouse.com/tags/AMD" class="mention hashtag" rel="nofollow noopener" target="_blank">#AMD</a> <a href="https://toot.majorshouse.com/tags/Ryzen" class="mention hashtag" rel="nofollow noopener" target="_blank">#Ryzen</a> <a href="https://toot.majorshouse.com/tags/Vulnerability" class="mention hashtag" rel="nofollow noopener" target="_blank">#Vulnerability</a> <a href="https://toot.majorshouse.com/tags/Hardware" class="mention hashtag" rel="nofollow noopener" target="_blank">#Hardware</a> <a href="https://toot.majorshouse.com/tags/GamingNews" class="mention hashtag" rel="nofollow noopener" target="_blank">#GamingNews</a> <a href="https://toot.majorshouse.com/tags/TechNews" class="mention hashtag" rel="nofollow noopener" target="_blank">#TechNews</a>

Thomas HurstI added a known-good microcode check to my <a href="https://hachyderm.io/tags/FreeBSD" class="mention hashtag" rel="nofollow noopener" target="_blank">#FreeBSD</a> <a href="https://hachyderm.io/tags/Zenbleed" class="mention hashtag" rel="nofollow noopener" target="_blank">#Zenbleed</a> MSR chicken-bit rc script, and a reminder to check it all again in mid-December.I don't have the relevant CPUs to hand to test it directly so do let me know how you get on.<a href="https://gist.github.com/Freaky/2560975d3c94246b86f464b8be75c967" rel="nofollow noopener" target="_blank">https://gist.github.com/Freaky/2560975d3c94246b86f464b8be75c967</a>

FCLC<a href="https://social.treehouse.systems/@Violet" class="u-url mention" rel="nofollow noopener" target="_blank">@Violet</a> This years <a href="https://mast.hpc.social/tags/defcon" class="mention hashtag" rel="nofollow noopener" target="_blank">#defcon</a> looks ripe with CPU vulnerabilities. <a href="https://mast.hpc.social/tags/Zenbleed" class="mention hashtag" rel="nofollow noopener" target="_blank">#Zenbleed</a> last week for AMDtoday: <a href="https://mast.hpc.social/tags/Downfall" class="mention hashtag" rel="nofollow noopener" target="_blank">#Downfall</a> for Intel<a href="https://mast.hpc.social/tags/Inception" class="mention hashtag" rel="nofollow noopener" target="_blank">#Inception</a> for AMD

tjhowseMaximum oof:> It took a bit of work, but I found a variant that can leak about 30 kb per core, per second.There's a nice clear explanation here: <a href="https://lock.cmpxchg8b.com/zenbleed.html" rel="nofollow noopener" target="_blank">https://lock.cmpxchg8b.com/zenbleed.html</a> <a href="https://howse.social/tags/zenbleed" class="mention hashtag" rel="nofollow noopener" target="_blank">#zenbleed</a>

Ubuntu SecurityOn the <a href="https://ubuntu.social/@ubuntu" class="u-url mention">@ubuntu</a> <a href="https://fosstodon.org/tags/Security" class="mention hashtag" rel="tag">#Security</a> Podcast this week we look at the AMD <a href="https://fosstodon.org/tags/Zenbleed" class="mention hashtag" rel="tag">#Zenbleed</a> vuln plus we cover security updates for the Linux kernel, a high profile OpenSSH vuln and finally Andrei is back covering recent academic research in machine learning safeguards <a href="https://ubuntusecuritypodcast.org/episode-204/" target="_blank" rel="nofollow noopener" translate="no">https://ubuntusecuritypodcast.org/episode-204/</a>

Jeroen Ruigrok van der WervenThe <a href="https://mastodon.social/tags/AMD" class="mention hashtag" rel="nofollow noopener" target="_blank">#AMD</a> <a href="https://mastodon.social/tags/Zenbleed" class="mention hashtag" rel="nofollow noopener" target="_blank">#Zenbleed</a> writeup by <a href="https://social.sdf.org/@taviso" class="u-url mention" rel="nofollow noopener" target="_blank">@taviso</a> is some interesting reading:<a href="https://lock.cmpxchg8b.com/zenbleed.html" rel="nofollow noopener" translate="no" target="_blank">https://lock.cmpxchg8b.com/zenbleed.html</a>

The RegisterUnfortunately <a href="https://geeknews.chat/@theregister" class="u-url mention" rel="nofollow noopener" target="_blank">@theregister</a> published misleading and incorrect information that using QEMU (i.e. KVM / Firecracker) mitigates the AMD <a href="https://geeknews.chat/tags/Zenbleed" class="mention hashtag" rel="nofollow noopener" target="_blank">#Zenbleed</a> exploit._It does not_We demo the exploit in a GitHub Action and show how to mitigate it. <a href="https://actuated.dev/blog/amd-zenbleed-update-now" rel="nofollow noopener" target="_blank">https://actuated.dev/blog/amd-zenbleed-update-now</a><a href="https://geeknews.chat/tags/bot" class="mention hashtag" rel="nofollow noopener" target="_blank">#bot</a> Original tweet : <a href="https://nitter.it/alexellisuk/status/1685952872125460480" rel="nofollow noopener" target="_blank">https://nitter.it/alexellisuk/status/1685952872125460480</a>

Hopbox by UnmuktiFIxes for AMD 'Zenbleed' CVE-2023-20593 has landed in Debian archives. For stable (bookworm), vulnerability is fixed in Linux version 6.1.38-2 and for old-stable (bullseye) fix is in version 5.10.179-3. This only fixes for 2nd gen Epyc CPUs, further CPUs to follow in later releases. Please update your Debian (and downstream) servers.<a href="https://mastodon.hopbox.net/tags/debian" class="mention hashtag" rel="nofollow noopener" target="_blank">#debian</a> <a href="https://mastodon.hopbox.net/tags/zenbleed" class="mention hashtag" rel="nofollow noopener" target="_blank">#zenbleed</a> <a href="https://mastodon.hopbox.net/tags/hopbox" class="mention hashtag" rel="nofollow noopener" target="_blank">#hopbox</a>

WinFuture.deEine neu entdeckte Sicherheitslücke bedroht zahlreiche -AMD-Prozessoren. Die meisten Patches kommen erst in Richtung Jahresende. <a href="https://mastodon.social/tags/Zenbleed" class="mention hashtag" rel="nofollow noopener" target="_blank">#Zenbleed</a> <a href="https://winfuture.de/news,137655.html?utm_source=Mastodon&utm_medium=ManualStatus&utm_campaign=SocialMedia" rel="nofollow noopener" translate="no" target="_blank">https://winfuture.de/news,137655.html?utm_source=Mastodon&utm_medium=ManualStatus&utm_campaign=SocialMedia</a>

Harry Sintonen<a href="https://infosec.exchange/tags/Debian" class="mention hashtag" rel="nofollow noopener" target="_blank">#Debian</a> has released a mitigation for the <a href="https://infosec.exchange/tags/zenbleed" class="mention hashtag" rel="nofollow noopener" target="_blank">#zenbleed</a> vulnerability CVE-2023-20593: "[DSA 5461-1] linux security update"This kernel update will identify if the CPU is affected (and no microcode update has been installed) and enable the "chicken bit" if needed.<a href="https://lists.debian.org/debian-security-announce/2023/msg00153.html" rel="nofollow noopener" translate="no" target="_blank">https://lists.debian.org/debian-security-announce/2023/msg00153.html</a>

PrivacyDigest<a href="https://mas.to/tags/AMD" class="mention hashtag" rel="nofollow noopener" target="_blank">#AMD</a> 'Zenbleed' Bug Leaks Data From Zen 2 <a href="https://mas.to/tags/Ryzen" class="mention hashtag" rel="nofollow noopener" target="_blank">#Ryzen</a>, <a href="https://mas.to/tags/EPYC" class="mention hashtag" rel="nofollow noopener" target="_blank">#EPYC</a> CPUs: Most Patches Coming Q4 (Updated) | Tom's Hardware <a href="https://mas.to/tags/zenbleed" class="mention hashtag" rel="nofollow noopener" target="_blank">#zenbleed</a> <a href="https://mas.to/tags/privacy" class="mention hashtag" rel="nofollow noopener" target="_blank">#privacy</a> <a href="https://www.tomshardware.com/news/zenbleed-bug-allows-data-theft-from-amds-zen-2-processors-patches-released" rel="nofollow noopener" target="_blank">https://www.tomshardware.com/news/zenbleed-bug-allows-data-theft-from-amds-zen-2-processors-patches-released</a>

Recent searches

Search options

Administered by:

Server stats:

#zenbleed