Zen and the Art of Microcode Hacking - Google Bug Hunters
This blog post covers the full details of EntrySign, the AMD Zen microcode signature validation vulnerability recently discovered by the Google Security team.
Fig. 1. The EntrySign vulnerability logo (CCO) Today we are releasing the full details of EntrySign, the AMD Zen microcode signature validation vulnerability which we initially disclosed last month. In this post, we first discuss the background of what microcode is, why microcode patches exist, why the integrity of microcode is important for security, and how AMD attempts to prevent tampering with microcode. Next, we focus on the microcode patch signature validation process and explain in detail the vulnerability present (using CMAC as a hash function). Finally, we discuss how to use some…
saved by
related reading
- Zenbleedlock.cmpxchg8b.com
- Reading privileged memory with a side-channel - Project Zerogoogleprojectzero.blogspot.com
- Meta harness makes 10 times better Kimi K3 chipluoluo.ai
- Hardware Acceleration for Zero Knowledge Proofs - Paradigmparadigm.xyz
- ZK-Friendly Hash Functions | Zellic — Researchzellic.io
- Ken Shirriff's blogrighto.com
- Google's Fully Homomorphic Encryption Compiler — A Primer || Math ∩ Programmingjeremykun.com
- Earn $200K by fuzzing for a weekend: Part 1 | secret clubsecret.club
- Semi-invasive attacks - A new approach to hardware security analysiscl.cam.ac.uk
- A fundamental introduction to x86 assembly programmingnayuki.io
- MSWasm: Soundly Enforcing Memory-Safe Execution of Unsafe Codecseweb.ucsd.edu
- 0xPARC0xparc.org