New 'Sinkclose' vulnerability in AMD CPUs, only way to remove it is to 'throw your PC away'

AMD Ryzen and EPYC processors have been exposed to a new vulnerability called "Sinkclose" which could affect millions and millions of AMD processors worldwide.

2

In a new report from WIRED, we're learning that the new "Sinkclose" vulnerability allows intruders to run malicious code on AMD processors when they're placed in "System Management Mode" which is a sensitive mode that holds crucial firmware files used for operations.

But, hackers will need to insert a piece of code that would provide them with "deep access to an AMD-based PC or server". Once the hackers have this access, they can install a malware called a bootkit, which is undetectable by anti-virus software, which is means to protect your PC.

Enrique Nissim and Krzysztof Okupski, researchers from the security firm IOActive, will present the new vulnerability in AMD processors that they're calling Sinkclose. Okupski told WIRED: "Imagine nation-state hackers or whoever wants to persist on your system. Even if you wipe your drive clean, it's still going to be there. It's going to be nearly undetectable and nearly unpatchable".

How would you remove the malware? Well, that's hard: you'd have to open up the PC, physically connect directly to a certain portion of its memory chips with a hardware-based programming tool called "SPI Flash" programmer, with Okupski saying you'd have to meticulously scour the memory to remove the malware.

Nissim says that the worst-case scenario would be "you basically have to throw your computer away".

AMD has issued a statement to WIRED, where they acknowledged it was hard to exploit Sinkclose, and that to take advantage of the vulnerability, hackers would need to have access to your computer's kernel, the core of the OS.