Sinkclose: Catastrophic vulnerability discovered in AMD chips

Security researchers have uncovered a serious vulnerability in AMD processors that has existed for decades. The security flaw has been dubbed “Sinkclose” and allows direct access to the System Management Mode (SMM). Moghimi / Svidras / Unsplash

Details about the vulnerability

The discovery of the “Sinkclose” vulnerability in AMD chips is a wake-up call for the entire IT security industry. As the Online magazine Wired reported, “Sinkclose” allows malicious software to access a computer’s memory and thus infect it sustainably and unnoticed. The problem was discovered by security researchers at IOActive, a renowned security company.

They found that the vulnerability lies in the firmware of AMD chips. The gap allows attackers to execute their code in System Management Mode (SMM), which is normally a highly protected area of ​​the firmware. To make matters worse, this vulnerability on AMD chips dates back to at least 2006, which means that almost all AMD processors are affected.

Catastrophic consequences

While this vulnerability could have potentially catastrophic consequences, the reassuring news is that it is extremely unlikely that regular users will be affected. To exploit the vulnerability, hackers would already need to have access to an AMD-based PC or server. This makes it unlikely for the average home PC, but poses a serious risk to businesses and large organizations, where access to a PC would be enough to hijack a network.

This vulnerability is particularly worrying for governments and similar organizations. The malicious code could burrow so deeply into the firmware that it would be almost undetectable and could even survive a complete reinstallation of the operating system.

Imagine if government hackers or whoever wants to get a hold of your system. Even if you wipe your drive, it will still be there. Krzysztof Okupski from IOActive

AMD response and measures

AMD has acknowledged the problem and also stressed how difficult it would be to exploit the vulnerability. The company compares exploiting the Sinkclose vulnerability to accessing a bank’s safety deposit boxes after all security measures have already been bypassed.

Nevertheless, AMD has released “mitigation options” for data center products and Ryzen PC products, while patches for embedded AMD products are expected to follow shortly. AMD has also released a full list of affected chips published and is working on patches. IOActive has agreed not to release proof-of-concept code while AMD works on patches, as speed will be of the essence in fixing this vulnerability.