I-AMD ibhengeze ukupheliswa kobuthathaka obungama-22 kwisizukulwana sokuqala, sesibini kunye nesesithathu se-AMD EPYC iiprosesa zeseva, ivumela ukusebenza kwe-PSP (iPlatform Security Processor), i-SMU (iYunithi yoLawulo lweSistim) kunye ne-SEV (i-Secure Encrypted Virtualization) ubuchwephesha ukuba buchaphazeleke. . Iingxaki ezi-6 zachongwa ngo-2020, kunye ne-16 ngo-2021. Ngexesha lophando lokhuseleko lwangaphakathi, ubuthathaka be-11 ichongiwe ngabasebenzi bakaGoogle, i-6 ngu-Oracle kunye ne-5 nguMicrosoft.
Iisethi ezihlaziyiweyo ze-AGESA (i-AMD Generic Encapsulated Software Architecture) i-firmware ikhululwe kubavelisi bezixhobo ze-OEM, ukuthintela ukwenzeka kweengxaki ngendlela ejikelezayo. Iinkampani ezifana ne-HP, i-Dell, i-Supermicro kunye ne-Lenovo sele ikhuphe i-BIOS kunye nohlaziyo lwe-firmware ye-UEFI kwiinkqubo zabo zeseva.
Ubuthathaka obu-4 buhlelwa bunobungozi (iinkcukacha azikachazwa):
- I-CVE-2020-12954 - ukukwazi ukudlula iindlela zokukhusela ze-SPI ROM ngokusetyenziswa kwezicwangciso ezithile ze-chipset zangaphakathi. Ubuthathaka buvumela umhlaseli enze utshintsho kwi-SPI Flash ukwazisa ikhowudi enobungozi okanye i-rootkits engabonakaliyo kwinkqubo.
- I-CVE-2020-12961 - ubuthathaka kwiprosesa ye-PSP (i-AMD Security Processor), esetyenziselwa ukuqhuba indawo ekhuselekileyo ekhuselweyo engafikelelekiyo kwi-OS engundoqo, ivumela umhlaseli ukuba abuyisele nayiphi na irejista yeprosesa kwi-SMN (Inethiwekhi yoLawulo lweSistim) kunye nokudlula. Ukhuseleko lwe-SPI ROM.
- I-CVE-2021-26331 - Impazamo kwi-SMU (Iyunithi yoLawulo lweSistim) edibeneyo kwiprosesa, esetyenziselwa ukulawula ukusetyenziswa kwamandla, i-voltage kunye nobushushu, ivumela umsebenzisi ongekho mthethweni ukuba afezekise ukuphunyezwa kwekhowudi ngamalungelo aphakamileyo.
- I-CVE-2021-26335 -Ukuqinisekiswa kwedatha engafanelekanga kwikhowudi yokulayishwa kweprosesa ye-PSP kwenza kube lula ukusebenzisa amaxabiso alawulwa ngumhlaseli kwinqanaba ngaphambi kokujonga utyikityo lwedijithali kunye nokufezekisa ukuphunyezwa kwekhowudi yabo kwi-PSP.
Ngokwahlukileyo, kuqatshelwe ukuba i-vulnerability (CVE-2021-26334) isusiwe kwi-AMD μProf toolkit, ebonelelwa, phakathi kwezinye izinto, ukuze Linux kunye neFreeBSD, kwaye isetyenziselwa uhlalutyo lokusebenza kunye nokusetyenziswa kwamandla. Ingxaki ikhona kwi-AMDPowerProfiler driver kwaye ivumela umsebenzisi ongenamalungelo okufikelela kwiirejista zeModel-Specific Register (MSR) ukuze alungiselele ukuphunyezwa kwekhowudi yakhe kwinqanaba lokukhusela indandatho 0 (indandatho-0). Ubuthathaka bulungisiwe kuhlaziyo lwe-amduprof-3.4-502 lwe Linux kunye ne-AMDuProf-3.4.494 ye Windows.
Ngeli xesha, i-Intel ipapashe iingxelo zekota malunga nokuba semngciphekweni kwiimveliso zayo, apho ezi ngxaki zilandelayo zivela khona:
- I-CVE-2021-0146 bubuthathaka kwi-Intel Pentium, iCeleron kunye ne-Atom iprosesa kwiinkqubo zeselula kunye ne-desktop evumela umsebenzisi ukuba afikelele ngokomzimba kwisixhobo ukufezekisa ukunyuswa kwamalungelo ngokuvula iindlela zokulungisa.
- I-CVE-2021-0157, i-CVE-2021-0158 zibuthathaka kwikhowudi yereferensi ye-BIOS ebonelelwe ukuqaliswa kwe-Intel Xeon (E / W / Scalable), i-Core (7/10/11gen), i-Celeron (N) kunye ne-Pentium yeSilivere yeprosesa. Imiba ibangelwa kukuqinisekiswa kwegalelo elingalunganga okanye ulawulo lokuhamba ngendlela engafanelekanga kwi-firmware ye-BIOS kwaye ivumele ukunyuka kwamalungelo xa ukufikelela kwendawo kufumaneka.
umthombo: opennet.ru
