IOActive researchers detail “Sinkclose”, a vulnerability in almost all AMD chips dating back to 2006 that allows attackers to run code in System Management Mode
Researchers warn that a bug in AMD's chips would allow attackers to root into some of the most privileged portions of a computer … X: @ioactive , @notolymp1a , and @a_greenberg Forums: r/hardware and r/cybersecurity X: @ioactive : “Researchers warn that a bug in AMD's chips would allow attackers to root into some of the most privileged portions of a computer...” New piece from @WIRED featuring research from IOActive Principal Security Consultants, Enrique Nissim & Krzysztof Okupski. https://www.wired.com/... @notolymp1a : I wonder how many government computers run AMD chips? https://www.wired.com/... Andy Greenberg / @a_greenberg : At Defcon tomorrow, researchers will reveal a flaw in hundreds of millions of AMD chips they call “Sinkclose,” which would let hackers root into some of the most privileged portions of a computer to install virtually undetectable, unfixable malware. https://www.wired.com/... Forums: r/hardware : ‘Sinkclose’ Flaw in Hundreds of Millions of AMD Chips Allows Deep, Virtually Unfixable Infections r/cybersecurity : “'Sinkclose' Flaw in Hundreds of Millions of AMD Chips”
Context & Ripple Effects
Sinkclose extends a recurring AMD security record: earlier coverage documented alleged Ryzen and EPYC flaws capable of placing malware in protected chip areas, underscoring why firmware-level issues are unusually consequential.
The disclosure was quickly followed by AMD mitigation updates, though that coverage says several older Ryzen and Threadripper generations would not receive updates. That turns a newly disclosed flaw into a lifecycle-management issue as well as an incident-response one.
First-order effects
- Organizations using affected AMD systems must assess exposure to an attack path that reaches System Management Mode, where code can be difficult to detect and remove.
- AMD faces immediate pressure to provide mitigations and clear support guidance across a chip range that the researchers say reaches back to 2006.
Second-order effects
- The later update plan excluding some older CPU families leaves operators of those systems to weigh compensating controls, hardware replacement, or continued residual risk.
- Security teams and device suppliers will need to treat firmware and platform support status as part of endpoint inventory, rather than relying only on operating-system-level remediation.
Third-order effects
- If long-lived firmware flaws continue to surface across broad installed bases, processor security support windows will become a more important competitive and procurement criterion.
- The case reinforces an ecosystem-defense model in which chip vendors, system makers, and enterprise operators share responsibility for remediation; its lasting impact depends on how broadly updates can be deployed.
The trend: Sinkclose is one data point in the shift from software-only patching toward lifecycle security management for deeply embedded hardware and firmware layers.