The issue was this leaking of previously stored data in system memory, due to reusing the system memory without re-initializing it.
> If the userspace aapplication requests to initialise 1 byte,
> the driver will round that up to a full 4096 bytes, and allocate that much memory.
>
> However, it will only initialise the first byte, leaving the rest in its prior state.
> The user can then access the remaining 4095 bytes which have been untouched,
> thus gaining access to the contents of uninitialised memory.
Apparently patched in the currently available latest drivers starting from
Could I install those drivers to a Linux machine? I remember a couple of years ago I tried because of a Ryzen instability issue, but there seemed to be no way.
If you find or share any information to correlate your point, I'd be happy to read about it and change my mind. I can't prove a negative with the information that I have.
Until then, both AMD and myself both agree that this only affects the method that the Windows implementation uses. I don't think the AMD PSIRT team would misrepresent their findings too.
I wont say it will never affect the Linux PSP implementation, however the driver behaves differently.
I hate 'throwing credentials', but I do work for the Red Hat Product Security team and we have a line of communication with hardware vendors for this reason.
Ok. I think we are mixing 2 things here. This concrete CVE might not affect Linux. So my question how to install the given drivers is irrelevant.
However, in general all sources I read say that the PSP runs some closed source firmware and it has full access to the main memory. So that will always remain a nasty source of insecurity unless there is a switch to disable it (reportedly some BIOSes have such switch, but I have not heard about any 3rd party audit what such switch does.) Vendors will always tell you that their proprietary solution is secure and does not leak any data until someone can somewhat trustworthy demonstrate that they were wrong. Experience has shown that typically it's not a question of whether it happens, but when it happens. It can take years but someday some smart person finds a way. Some create a logo and a website to earn reputation. others earn money secretly.
No, I don't have any insider information you would not have. I just believe the information that it's an ARM processor running closed firmware and it has memory access.
ASLR might make exploits a more cumbersome to implement. But the PSP is a co-processor with full access to hardware. So it can read the kernel's memory maps and fully deterministically access whatever it wants to access.
Comments
This is https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-2633... originally discovered in April 2021.
The issue was this leaking of previously stored data in system memory, due to reusing the system memory without re-initializing it.
Apparently patched in the currently available latest drivers starting from- AMD PSP driver 5.17.0.0
- AMD Chipset Driver 3.08.17.735
https://www.amd.com/en/corporate/product-security/bulletin/a...
Could I install those drivers to a Linux machine? I remember a couple of years ago I tried because of a Ryzen instability issue, but there seemed to be no way.
I have done the linux analysis, it doesn't affect Linux.
The PSP is there despite Linux. It's a co-processor running closed source firmware. With all respect, I seriously doubt your analysis is correct.
If you find or share any information to correlate your point, I'd be happy to read about it and change my mind. I can't prove a negative with the information that I have.
Until then, both AMD and myself both agree that this only affects the method that the Windows implementation uses. I don't think the AMD PSIRT team would misrepresent their findings too.
I wont say it will never affect the Linux PSP implementation, however the driver behaves differently.
I hate 'throwing credentials', but I do work for the Red Hat Product Security team and we have a line of communication with hardware vendors for this reason.
Ok. I think we are mixing 2 things here. This concrete CVE might not affect Linux. So my question how to install the given drivers is irrelevant.
However, in general all sources I read say that the PSP runs some closed source firmware and it has full access to the main memory. So that will always remain a nasty source of insecurity unless there is a switch to disable it (reportedly some BIOSes have such switch, but I have not heard about any 3rd party audit what such switch does.) Vendors will always tell you that their proprietary solution is secure and does not leak any data until someone can somewhat trustworthy demonstrate that they were wrong. Experience has shown that typically it's not a question of whether it happens, but when it happens. It can take years but someday some smart person finds a way. Some create a logo and a website to earn reputation. others earn money secretly.
No, I don't have any insider information you would not have. I just believe the information that it's an ARM processor running closed firmware and it has memory access.
I think OS level mitigations like ASLR (address space layout randomization) can help...
What causes (and avoids) it in drivers can be reproduced/bypassed elsewhere
ASLR might make exploits a more cumbersome to implement. But the PSP is a co-processor with full access to hardware. So it can read the kernel's memory maps and fully deterministically access whatever it wants to access.