TUXEDO OS update closes sinkclose gap in AMD processors - TUXEDO Computers

Security researchers at IOActive have uncovered a critical vulnerability in AMD CPUs that has existed for nearly two decades and affects countless processors. The vulnerability, known as Sinkclose, allows attackers to execute software in System Management Mode (SMM), a particularly privileged mode that is invisible to the operating system and other applications.

System Management Mode is typically used for low-level operations such as controlling hardware components or power management and operates at the highest protection ring, ring -2. Attackers could exploit the sinkhole to install bootkits that are invisible to the operating system or antivirus software and grant them full access to the system.

Sinkclose security vulnerability in AMD processors

Such a malware infection is not only difficult to detect, but also extremely time-consuming to remove. According to IOActive, removing the malware requires the use of a special hardware-based programming tool, the SPI Flash Programmer, to scan the memory directly. In the worst case scenario, this could result in the affected computer possibly no longer being fully functional

Although exploiting the Sinkclose vulnerability (CVE-2023–31315) is not easy due to its complexity and would require local root privileges, the researchers warn that new vulnerabilities are regularly discovered that allow the necessary kernel access. Attacks that grant kernel-level access are particularly relevant for state-sponsored hackers.

AMD provides a list of affected CPUs on its website, with updates already available for some Epyc, Athlon, and Ryzen processors. However, not all impacted processors will receive an update: the Ryzen 1000, 2000, and 3000 series are excluded, as reported by the German IT blog Computerbase. AMD states that these processors will no longer be supported due to their age; the Ryzen 1000 was released in 2017.

Updates already integrated in TUXEDO OS

Updates are already available for Linux that mitigate the error. They must be integrated into the system by the distributors. This has already been done for TUXEDO OS and other major Linux distros such as Debian or Ubuntu. The updates are included in the amd64-microcode package, which is automatically installed with the usual updates on your computer installed with TUXEDO OS.

For a final bug fix, the system requires a BIOS/firmware update provided by AMD and the motherboard manufacturers. We will keep you informed about this via This Week in TUXEDO OS and our Newsletter.