New AMD SinkClose flaw helps install nearly undetectable malware (www.bleepingcomputer.com)

submitted 3 months ago by DocMcStuffin@lemmy.world to c/cybersecurity@sh.itjust.works

20 comments fedilink hide all child comments

AMD is warning about a high-severity CPU vulnerability named SinkClose that impacts multiple generations of its EPYC, Ryzen, and Threadripper processors. The vulnerability allows attackers with Kernel-level (Ring 0) privileges to gain Ring -2 privileges and install malware that becomes nearly undetectable.

Tracked as CVE-2023-31315 and rated of high severity (CVSS score: 7.5), the flaw was discovered by IOActive Enrique Nissim and Krzysztof Okupski, who named privilege elevation attack 'Sinkclose.'

Full details about the attack will be presented by the researchers at tomorrow in a DefCon talk titled "AMD Sinkclose: Universal Ring-2 Privilege Escalation."

you are viewing a single comment's thread
view the rest of the comments

[-] BigSadDad@lemmy.world 7 points 3 months ago

For everyone who's posting but didn't actually read the CVE...

You need Malware with Kernel level access Already. Besides Anti Cheat for modern games, if you have malware with Kernel level access you're already really fucked.

In addition, this just appears to be a way for that Kernel malware to persist in a device. It's not impossible to detect. I wouldn't be surprised if we saw Windows Defender signatures for malware using it within the month.

I haven't seen the Def Con presentation, but the CVE is a "Maybe". There is no PoC (Proof of Concept, showing that an exploit works)...yet. keep an eye on that.

The CVE claims this "Could Maybe" allow based on logic, but none of the sources i found showed anyone actually using it. Maybe the Def Con presentation will. But unless I see someone post a repeatable exploit in a real world scenario, it feels superficial.

I want to reiterate that this IS a flaw and it IS a problem. But I would highly doubt you, rando consumer, will be affected.

Mitigations are to not be dumb on the Internet. Keep your browser updated and make sure your sensitive data is backed up and encrypted, basic stuff.

Happy to go in to it more. This is my jam.

this post was submitted on 10 Aug 2024

49 points (90.2% liked)

Cybersecurity

5734 readers

13 users here now

c/cybersecurity is a community centered on the cybersecurity and information security profession. You can come here to discuss news, post something interesting, or just chat with others.

THE RULES

Instance Rules

Be respectful. Everyone should feel welcome here.
No bigotry - including racism, sexism, ableism, homophobia, transphobia, or xenophobia.
No Ads / Spamming.
No pornography.

Community Rules

Idk, keep it semi-professional?
Nothing illegal. We're all ethical here.
Rules will be added/redefined as necessary.

If you ask someone to hack your "friends" socials you're just going to get banned so don't do that.

Learn about hacking

Hack the Box

Try Hack Me

Pico Capture the flag

Other security-related communities !databreaches@lemmy.zip !netsec@lemmy.world !cybersecurity@lemmy.capebreton.social !securitynews@infosec.pub !netsec@links.hackliberty.org !cybersecurity@infosec.pub !pulse_of_truth@infosec.pub

Notable mention to !cybersecuritymemes@lemmy.world

founded 1 year ago

MODERATORS

kid@sh.itjust.works

Lanky_Pomegranate530@midwest.social