Security researchers have discovered 13 critical Spectre/Meltdown-like vulnerabilities throughout AMD's Ryzen and EPYC lines of processors that could allow attackers to access sensitive data, install persistent malware inside the chip, and gain full access to the compromised systems.

All these vulnerabilities lie in the secure part of the AMD's Zen architecture processors and chipsets—typically where device stores sensitive information such as passwords and encryption keys and makes sure nothing malicious is running when you start your PC.

The unpatched vulnerabilities are categorized into four classes—RYZENFALL, FALLOUT, CHIMERA, and MASTERKEY—and threaten wide-range of servers, workstations, and laptops running vulnerable AMD Ryzen, Ryzen Pro, Ryzen Mobile or EPYC processors.

Discovered by the team of researchers at Israel-based CTS-Labs, newly disclosed vulnerabilities defeat AMD's Secure Encrypted Virtualization (SEV) technology and could allow attackers to bypass Microsoft Windows Credential Guard to steal network credentials.

Moreover, researchers also found two exploitable manufacturer backdoors inside Ryzen chipset that could allow attackers to inject malicious code inside the chip.
AMD's Ryzen chipsets are found in desktop and laptop computers, while EPYC processors in servers. Researchers successfully tested the vulnerabilities in 21 different products and believed 11 more products are also vulnerable to the issues.

Here's the brief explanation of all the vulnerabilities:

RYZENFALL (v1, v2, v3, v4) AMD Vulnerabilities

These flaws reside in AMD Secure OS and affect Ryzen secure processors (workstation/pro/mobile).

According to researchers, RYZENFALL vulnerabilities allow unauthorized code execution on the Ryzen Secure Processor, eventually letting attackers access protected memory regions, inject malware into the processor itself, and disable SMM protections against unauthorized BIOS reflashing.

Attackers could also use RYZENFALL to bypass Windows Credential Guard and steal network credentials, and then use the stolen data to spread across to other computers within that network (even highly secure Windows corporate networks).

RYZENFALL can also be combined with another issue called MASTERKEY (detailed below) to install persistent malware on the Secure Processor, "exposing customers to the risk of covert and long-term industrial espionage."

FALLOUT (v1, v2, v3) AMD Vulnerabilities

These vulnerabilities reside in the bootloader component of EPYC secure processor and allow attackers to read from and write to protected memory areas, such as SMRAM and Windows Credential Guard isolated memory.

FALLOUT attacks only affect servers using AMD's EPYC secure processors and could be exploited to inject persistent malware into VTL1, where the Secure Kernel and Isolated User Mode (IUM) execute code.

Like RYZENFALL, FALLOUT also let attackers bypass BIOS flashing protections, and steal network credentials protected by Windows Credential Guard.

"EPYC servers are in the process of being integrated into data centers around the world, including at Baidu and Microsoft Azure Cloud, and AMD has recently announced that EPYC and Ryzen embedded processors are being sold as high-security solutions for mission-critical aerospace and defense systems," researchers say. 

"We urge the security community to study the security of these devices in depth before allowing them on mission-critical systems that could potentially put lives at risk."

CHIMERA (v1, v2) AMD Vulnerabilities

These two vulnerabilities are actually hidden manufacturer backdoors inside AMD's Promontory chipsets that are an integral part of all Ryzen and Ryzen Pro workstations.
One backdoor has been implemented in firmware running on the chip, while the other in the chip's hardware (ASIC), and allow attackers to run arbitrary code inside the AMD Ryzen chipset, or to re-flash the chip with persistent malware.

Since WiFi, network and Bluetooth traffic flows through the chipset, an attacker could exploit the chipset's man-in-the-middle position to launch sophisticated attacks against your device.

"This, in turn, could allow for firmware-based malware that has full control over the system, yet is notoriously difficult to detect or remove. Such malware could manipulate the operating system through Direct Memory Access (DMA), while remaining resilient against most endpoint security products," researchers say.

According to the researchers, it may be possible to implement a stealthy keylogger by listening to USB traffic that flows through the chipset, allowing attackers to see everything a victim types on the infected computer.

"Because the latter has been manufactured into the chip, a direct fix may not be possible, and the solution may involve either a workaround or a recall," researchers warn.

MASTERKEY (v1, v2, v3) AMD Vulnerabilities

These three vulnerabilities in EPYC and Ryzen (workstation/pro/mobile) processors could allow attackers to bypass hardware validated boot to re-flash BIOS with a malicious update and infiltrate the Secure Processor to achieve arbitrary code execution.

Like RYZENFALL and FALLOUT, MASTERKEY also allows attackers to install stealthy and persistent malware inside AMD Secure Processor, "running in kernel-mode with the highest possible permissions," as well as bypass Windows Credential Guard to facilitate network credential theft.

MASTERKEY vulnerabilities also allow attackers to disable security features such as Firmware Trusted Platform Module (fTPM) and Secure Encrypted Virtualization (SEV).

CTS-Lab researchers gave just 24 hours to the AMD team to look at all vulnerabilities and respond before going public with their details—that's hell quick for any company to understand and patch the critical level issues properly.
While Intel and Microsoft are still managing its patches for Meltdown and Spectre vulnerabilities, the newly discovered vulnerabilities could create similar trouble for AMD and its customers.

So, let's wait and watch when the company comes up with fixes, though the researchers said it could take "several months to fix" all the issues.

For more detailed information about the vulnerabilities, you can head on to this paper [PDF] titled, "Severe Security Advisory on AMD Processors," published by CTS-Lab.