[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Message-ID: <bfaecb7c-25a9-406a-a4ca-a55a32c3ae43@citrix.com>
Date: Sat, 8 Mar 2025 01:28:07 +0000
From: Andrew Cooper <andrew.cooper3@...rix.com>
To: Solar Designer <solar@...nwall.com>
Cc: oss-security@...ts.openwall.com
Subject: Re: Xen Security Notice 2 (CVE-2024-35347) AMD CPU
Microcode Signature Verification Vulnerability
On 06/03/2025 4:48 am, Solar Designer wrote:
> On Thu, Mar 06, 2025 at 04:11:25AM +0000, Andrew Cooper wrote:
>> This issue wins points for spite, because the highest risk users are the
>> ones who were taking proactive steps to try and improve their security,
>> betting that AMD's patchloader crypto was sound.
> OK, so this is to protect legitimate sysadmins from loading malicious
> microcode inadvertently or via a supply chain attack. Makes sense.
Sorry for the delay, I knew there was a distro formally doing this, but
I'd lost track of the links.
https://github.com/divestedcg/real-ucode which is packaged for Arch as
https://aur.archlinux.org/packages/amd-real-ucode-git (and an equivalent
Intel package).
~Andrew
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
