Addressing Microcode Signature Vulnerabilities

How AMD is Working to Strengthen Product Security

At AMD, we endeavor to continually and proactively strengthen the security of our products to stay ahead of novel and evolving threats. 

Upon researchers from Google having informed AMD of a microcode signature verification vulnerability affecting our Zen through Zen 4 based products¹, the teams at AMD promptly addressed the vulnerability by developing enhanced techniques to improve signature verification. The teams also proactively explored potential attack variants, including risks to Zen 5-based products.

AMD takes a proactive approach to identify and protect against potential risk with respect to AMD products. For example, AMD worked closely with industry experts to design, validate, and deploy a new signature verification solution in a technically constrained environment across our product stack.  This solution mitigates against advanced techniques (e.g., cold boot attacks, side-channel attacks, power analysis, etc) across our product stack, including Zen 5-based systems.

To further the robustness of this mitigation, we engaged independent third-party auditors to review both the new algorithm and its implementation. Their analysis supported our decision to deploy a new signature verification solution, and reinforced our commitment to design strong, reliable security protections.  Mitigations have been released for the Zen 5-based systems.

Security is not a one-time effort at AMD. We are constantly working — both internally and across the industry — to identify, address, and stay ahead of security vulnerabilities. We remain committed to helping protect our customers and advancing the security of the computing ecosystem.

For more information about AMD Product Security, including security notices, vulnerability reporting, and our bug bounty program, please visit https://www.amd.com/en/resources/product-security.html