Zen CPUs Might Be Hit By 4 New Flaws UPDATED

[SteelCrysis]

http://www.tomshardware.com/news/amd-res...36707.html

AMD has finally issued a full response to CTS Labs’ report that Ryzen and EPYC processors contain a total of 13 security flaws. Here’s the short version of the chipmakers’ response:

• Exploitation of the vulnerabilities requires admin access
  
• The vulnerabilities have to do with firmware and chipsets, not the x86 architecture
  
• Patches are coming in the form of BIOS updates and firmware patches only--no microcode updates are required--via OEMs and ODMs
  
• All issues will be addressed within “weeks,” but we strongly infer that AMD is aiming for 90 days or less
  
• There is no expected performance impact
  

...
Note that in AMD’s response, it condensed CTS Labs’ four threat categories into three. In all three, AMD stated that admin access is required, and all the attacks would require that the system’s security has already been compromised.

Expect all patches to arrive via AMD’s ODM and OEM partners within the next 90 days.