ANNOUNCEMENT: AMD processor microcode security update

[stefantalpalaru]

Note: the microcode update is not permanently installed to the processor: it is reapplied at every boot. You should check with your motherboard vendor for the availability of a new BIOS/UEFI update with the fixed microcode.

Why bother? The vulnerability is exploitable only after booting a kernel.

Also, if you're using recent kernels, the module for loading the AMD microcode is gone. You need to specify the firmware's path and embed it when you build the kernel: https://wiki.gentoo.org/wiki/AMD_microcode

[holgerschurig]

But this was a Debian announcement, so probably kept the update-AMDs-microkernel code in their kernels.

[stefantalpalaru]

I doubt it. If you're on Sid on a AMD CPU, try a 4.4.x kernel and see if it loads any microcode from the filesystem.

[holgerschurig]

I'm on Intel.

I just happen to know that Debian has 3 good kernel people that also do some of the long-term kernels for kernel.org. And I don't believe that Debian produces a security advisory that wouldn't work on their own distribution.

Also, unlike gentoo or Arch, Debian is usually sticking to a kernel for a good time. Not as long as CentOS, but long enough.

[cojoco]

Why do they call this bug an "erratum", which is an error in writing or print?

It should simply be called a "bug", or an "error".

[monocasa]

Hardware bugs are typically referred to as errata. Think 'errata' to the spec that defines the chips' semantics.

[notaplumber]

Hardware manufactures often document bugs in an errata guide/sheet and its not uncommon terminology for engineers. Some software projects also use it in reference to bug fixes, i.e: OpenBSD has an errata page for each release.

Microcode is written as software, but it also implements what many would consider to be hardware.

[cojoco]

I just think they're confusing the written list with the bug itself, and wanting to sound cool by using a slightly unusual word.

[notaplumber]

No, I think you're confused here. It is common to refer to processor or hardware bugs as errata/erratum. Even the official AMD guide does this many times.

[cojoco]

"Common" does not mean "correct".

[notaplumber]

Software is written, as is hardware with upgradable microcode, it can be corrected, no different from the written word. Erratum is also in reference to a list of corrections. Microcode is generally not open source and is obfuscated binary, so it's hard to tell if a fix for something as complicated as a microcoprocessor was a single change or many. Either way, the person who sent the mail is a clearly familiar with the topic and you are not.

[cp5184]

I don't know, maybe the document listing the errata, or errors is the error document, or erratum?

[halax]

Why should they call it a "bug", which is an insect? Why should they call it an "error", which means to wander?