this post was submitted on 12 Aug 2024

509 points (95.7% liked)

Selfhosted

40183 readers

510 users here now

A place to share alternatives to popular online services that can be self-hosted without giving up privacy or locking you into a service you don't control.

Rules:

Be civil: we're here to support and learn from one another. Insults won't be tolerated. Flame wars are frowned upon.
No spam posting.
Posts have to be centered around self-hosting. There are other communities for discussing hardware or home computing. If it's not obvious why your post topic revolves around selfhosting, please include details to make it clear.
Don't duplicate the full text of your blog or github here. Just post the link for folks to click.
Submission headline should match the article title (don’t cherry-pick information from the title to fit your agenda).
No trolling.

Resources:

selfh.st Newsletter and index of selfhosted software and apps
awesome-selfhosted software
awesome-sysadmin resources
Self-Hosted Podcast from Jupiter Broadcasting

Any issues on the community? Report it using the report flag.

Questions? DM the mods!

founded 1 year ago

MODERATORS

[email protected]

509

AMD won't patch all chips affected by severe data theft vulnerability — Ryzen 3000, 2000, and 1000 will not get patched for 'Sinkclose' (www.tomshardware.com)

submitted 3 months ago by [email protected] to c/[email protected]

183 comments fedilink hide all child comments

Here we are - 3600 which was still under manufacture 2-3 years ago are not get patched. Shame on you AMD, if it is true.

(page 4) 46 comments

sorted by: hot top controversial new old

[–] [email protected] 25 points 3 months ago (1 children)

AMD has unfortunately a long history of abandoning products before its reasonable on its graphics division. Its not really acceptable, up until earlier this year my NAS/server was running a 3600 and its only for power saving purposes I changed that as its still a very workable CPU in that role.

[–] [email protected] 12 points 3 months ago (3 children)

Er I'm still running a FX-8350 as a gaming machine (not AAA games obviously). I had another one as a host for a few VMs and it was more than enough till the motherboard went. One day I'll upgrade I guess.

load more comments (3 replies)

[–] [email protected] 106 points 3 months ago (3 children)

Really not good enough from AMD. I wonder if Intel wasn't a complete dumpster fire right now if they would still cut off the fix at Zen 3 (I doubt it). There's really no reason not to issue a fix for these other than they don't want to pay the engineers for the time to do it, and they think it won't cost them any reputational damage.

I hate that every product and company sucks so hard these days.

load more comments (3 replies)

[–] [email protected] 40 points 3 months ago (4 children)

lol for the past 15 years I have "rebuilt" my desktop every 5 years but I didn't expect the would try to force me out of my 7 3700x right on the date

load more comments (4 replies)

[–] [email protected] 31 points 3 months ago (2 children)

How severe is this vulnerability?

[–] [email protected] 15 points 3 months ago (1 children)

You need to be a root to exploit it, but if it get exploited any way to get rid of it is to throw MB to trash.

[–] [email protected] 8 points 3 months ago (1 children)

Patch/reflash with a new bios?

[–] [email protected] 6 points 3 months ago (3 children)

How do you trust that the flash was done properly if you did it from the compromised system? This would only work if you flashed it externally somehow without the system running.

[–] [email protected] 2 points 3 months ago (1 children)

¯\_(ツ)_/¯

load more comments (1 replies)

load more comments (2 replies)

[–] [email protected] 64 points 3 months ago (2 children)

The good news is that in order to exploit the new vulnerability, the attacker first has to obtain kernel level access to the system somehow - by exploiting some other vulnerabilities perhaps.

The bad news is once Sinkclose attack is performed, it can be hard to detect and mitigate: it can even survive an OS reinstall.

[–] [email protected] 10 points 3 months ago (3 children)

The other bad news: there are so many vulnerabilities on all systems which can be used to gain root-level access, it's just a matter of time. Also, even future vulnerabilities will be an issue, as the underlying Sinkclose attacks will still work.

load more comments (3 replies)

[–] [email protected] 54 points 3 months ago (2 children)

So basically what you are saying is we just need one pvp game with kernel level anti cheat to fuck up somewhere...... yeah I'm sure that's not going to happen.

[–] [email protected] 12 points 3 months ago (7 children)

Probably only on a targeted attack. I don't see it being a mass target attack like a worm could be.
And in the realm of businesses, how many programs are running in kernel level besides the antivirus/ED(P)R solution?

[–] [email protected] 12 points 3 months ago

And with crowd strike we have seen how reliable Antivirus is.

load more comments (6 replies)

[–] [email protected] 169 points 3 months ago (3 children)

That's so stupid, also because they have fixes for Zen and Zen 2 based Epyc CPUs available.

Intel vs. AMD isn't "bad guys" vs. "good guys". Either company will take every opportunity to screw their customers over. Sure, "don't buy Intel" holds true for 13th and 14th gen Core CPUs specifically, but other than that it's more of a pick your poison.

[–] [email protected] 1 points 3 months ago (1 children)

“Both sides”

“Vote third party!”

Wtf seriously this isn’t the same thing remotely but the arguments used are.

load more comments (1 replies)

[–] [email protected] 61 points 3 months ago (16 children)

Tangent: If we started buying risc-v systems we might get to a point where they can actually compete.

[–] [email protected] 13 points 3 months ago (1 children)

Jeff Geerling had a video recently about the state of RISC V for desktop. https://youtu.be/YxtFctEsHy0?si=SUQBiepSeOne8-2u

load more comments (1 replies)

[–] [email protected] 47 points 3 months ago (1 children)

That's still far away from us as a consumer standpoint, but I'm eagerly waiting for a time when I could buy a RISC V laptop with atleast midrange computing capabalities

[–] [email protected] 7 points 3 months ago (1 children)

I‘m more on the builder/tinkerer side so I‘m pretty much in starting position with risc-v now. But yes, its going to be some time before any of it is user ready as a pc.

[–] [email protected] 11 points 3 months ago (5 children)

Framework has a laptop in progress if you're interested

load more comments (5 replies)

load more comments (14 replies)

[+] [email protected] -40 points 3 months ago (1 children)

How is AMD "screwing us over"? Surely they aren't doing this on purpose? That seems very cynical.

[–] [email protected] 67 points 3 months ago* (last edited 3 months ago) (1 children)

They are 100% not patching old chips intentionally by not allocating resources to it. It's a conscious choice made by the company, it is very much "on purpose".

[+] [email protected] -13 points 3 months ago (5 children)

That's not what I was referring to. I was referring to the act of "adding vulnerabilities". Surely they aren't doing that on purpose. And surely they would add fixes for it if it was economically viable? It's a matter of goodwill and reputation, right?

I don't know, I just don't think it's AMD's business model to "screw over" their customers. I just don't.

[–] [email protected] 14 points 3 months ago (8 children)

No, but those vulnerabilities where there when you bought it.

Would a car have a defect that was shown 5 years later, then the manufacturer would have to recall it or offer a repair program and or money in exchange.

Since everything is proprietary you cannot even fix things like this by yourself. The manufacturer needs to be held liable.

load more comments (8 replies)

[–] [email protected] 15 points 3 months ago (1 children)

No they are just choosing not to roll out the fix to a known issue, which is screwing customers over on purpose (to increase profits). It's not a matter of goodwill, they sold a product that then turned out to have a massive security flaw, and now they don't want to fix even though they absolutely could.

[–] [email protected] 26 points 3 months ago (2 children)

What I mean by that is that they will take a huge disservice to their customers over a slight financial inconvenience (packaging and validating an existing fix for different CPU series with the same architecture).

I don't classify fixing critical vulnerabilities from products as recent as the last decade as "goodwill", that's just what I'd expect to receive as a customer: a working product with no known vulnerabilities left open. I could've bought a Ryzen 3000 CPU (maybe as part of cheap office PCs or whatever) a few days ago, only to now know they have this severe vulnerability with the label WONTFIX on it. And even if I bought it 5 years ago: a fix exists, port it over!

I know some people say it's not that critical of a bug because an attacker needs kernel access, but it's a convenient part of a vulnerability chain for an attacker that once exploited is almost impossible to detect and remove.

load more comments (1 replies)

load more comments (2 replies)

load more comments