The “EntrySign” exploit is just the troublesome pest that not only exposes AMD CPUs made with “Zen” architecture from generation 1 through 4, but now even the new “Zen 5” offerings are getting affected, according to the newly updated advisory notice posted by Team Red.
The line of “Zen 5” models included the list covering the Ryzen 9000 series, Ryzen AI 300 mobile lineup, Ryzen 9000HX models, and EPYC 9005 server variants. As for the problem, it lies within AMD’s microcode patch loader, which could fail at times to properly verify digital signatures, allowing the unauthorized execution of arbitrary microcodes on the processor.
Although one may think that microcodes stored in ROM are immutable or “unchangable permanently”, Team Red and rival Intel actually do it the other way so that in times like this, they could update the microcode to fix any vulnerabilities, despite the updates being applied during the early boot process of each session.
However, the exploit itself requires local ring 0 access from the get-go, plus its mechanism does not allow it to stay “rooted” and instead be erased through a reboot. Therefore, its damage potential might be minimal in the consumer environment but detrimental in the server and enterprise settings where hardware is online almost 24/7. And yes, AMD’s SEV and SEV-SNP technologies made to protect virtual machines are also vulnerable to this exploit.
To fix up this issue, AMD’s new ComboAM5PI 1.2.0.3c AGESA firmware has been provided to motherboard vendors worldwide, so if your chosen brand has released this update for your particular board, be sure to update it straight away to have one less worry living rent-free in your head.
