AMD updates their customers regarding Spectre and processor security
AMD updates their customers regarding Spectre and processor security
To be clear, AMD stands by their “near zero” risk claims regarding Spectre Variant 2, with the exploit having never been demonstrated on an AMD processor. Regardless, AMD is taking steps to turn this “near-zero” risk into a no risk scenario, giving security conscious users the ability o pre-emotively install microcode updates that will provide them with total protection.Â
At this time it is unknown how these updates will be distributed, especially on a voluntary basis, though it is likely that these updates will be governed by as enable or disable option at a BIOS/UEFI level. These updates will be coming to both EPYC and Ryzen customers and partners.Â
This announcement does not mean that AMD is at any higher risk than previously announced, just that the company is taking additional steps to give their customers peace of mind and to prevent any potential future use of Spectre variant 2 on AMD Ryzen-based systems. Below is Mark Papermaster’s official update on AMD Processor SecurityÂ
 Â
   The public disclosure on January 3rd that multiple research teams had discovered security issues related to how modern microprocessors handle speculative execution has brought to the forefront the constant vigilance needed to protect and secure data. These threats seek to circumvent the microprocessor architecture controls that preserve secure data.
At AMD, security is our top priority and we are continually working to ensure the safety of our users as new risks arise. As a part of that vigilance, I wanted to update the community on our actions to address the situation.Google Project Zero (GPZ)
Variant 1 (Bounds Check Bypass or Spectre) is applicable to AMD processors.
– We believe this threat can be contained with an operating system (OS) patch and we have been working with OS providers to address this issue.Â
– Microsoft is distributing patches for the majority of AMD systems now. We are working closely with them to correct an issue that paused the distribution of patches for some older AMD processors (AMD Opteron, Athlon and AMD Turion X2 Ultra families) earlier this week. We expect this issue to be corrected shortly and Microsoft should resume updates for these older processors by next week. For the latest details, please see Microsoftâs website.
– Linux vendors are also rolling out patches across AMD products now.
GPZ Variant 2 (Branch Target Injection or Spectre) is applicable to AMD processors.
– While we believe that AMDâs processor architectures make it difficult to exploit Variant 2, we continue to work closely with the industry on this threat. We have defined additional steps through a combination of processor microcode updates and OS patches that we will make available to AMD customers and partners to further mitigate the threat.
– AMD will make optional microcode updates available to our customers and partners for Ryzen and EPYC processors starting this week. We expect to make updates available for our previous generation products over the coming weeks. These software updates will be provided by system providers and OS vendors; please check with your supplier for the latest information on the available option for your configuration and requirements.
– Linux vendors have begun to roll out OS patches for AMD systems, and we are working closely with Microsoft on the timing for distributing their patches. We are also engaging closely with the Linux community on development of âreturn trampolineâ (Retpoline) software mitigations.
There have also been questions about GPU architectures.Â
– AMD Radeon GPU architectures do not use speculative execution and thus are not susceptible to these threats.Â
We will provide further updates as appropriate on this site as AMD and the industry continue our collaborative work to develop mitigation solutions to protect users from these latest security threats.
 Â
 Â
With this update, AMD has also confirmed that none of their GPU architectures use any kind of speculative execution and are therefore not susceptible to either Spectre or Meltdown.Â
You can join the discussion on AMD’s update on processor security on the OC3D Forums.Â