AMD recently added two new client vulnerabilities that it discovered a few weeks ago and these issues may impact over 32 million PlayStation 5 console users.
The new issues found in AMD Ryzen CPUs affect its Secure Processor (SP) or System Management Unit (SMU) and the said vulnerabilities could lead to critical and difficult-to-patch vulnerabilities for machines equipped with these CPUs. According to reports, PS5 APUs, which are semi-custom AMD processors, could be affected by the newly found issues.
Hackers could possibly hijack consoles due to the critical bug on the processor. A hacker could gain control of the console on startup and potentially access critical information on the affected PS5 for future attacks. As with the previous Nintendo Switch hack, these types of attacks can be very damaging and extremely difficult for manufacturers to patch out.
What are the reported AMD vulnerabilities?
The two vulnerabilities added to AMD’s CVE Bulletin are CVE-2023-20558 and CVE-2023-20559. These issues affect Ryzen 2000, 3000, and 5000 series as well as the second and third-generation Ryzen Threadripper processors.
CVE-2023-20558 (Severity: High)
Insufficient control flow management in AmdCpmOemSmm may allow a privileged attacker to tamper with the SMM handler potentially leading to an escalation of privileges.
CVE-2023-20559 (Severity: High)
Insufficient control flow management in AmdCpmGpioInitSmm may allow a privileged attacker to tamper with the SMM handler potentially leading to escalation of privileges.
Both issues are related to the SMM handler found in AMD Ryzen CPUs. The SMM or System Management Mode is a "special-purpose operating mode provided for handling system-wide functions like power management, system hardware control, or proprietary OEM designed code. It is intended for use only by system firmware (BIOS or UEFI), not by applications software or general-purpose systems software."
The SMM is used for implementing power management and hardware control features like Advanced Power Management and it also manages system safety functions like shutdowns at high CPU temperatures.
The special operating mode can be abused to run high-privileged rootkits to run exploits and other security hacks, which is why it's often the target of malicious rootkits and exploits.
Hackers may exploit these new High Severity issues in combination with other previously known vulnerabilities. Users can prevent these sorts of attacks by regularly keeping the system BIOS updated as these can address security threats.
Hopefully, Sony will release a firmware update to address such issues. If your PC is running on an AMD Ryzen processor, it would be best to check for BIOS updates the next time you log on.
