An international team of researchers led by KU Leuven has discovered a vulnerability in AMD processors. AMD has now solved the problem.

AMD processors for cloud servers have been found to be vulnerable to memory communication tampering. This is what researchers from KU Leuven discovered in collaboration with the universities of Birmingham and Lübeck. Using a technique the researchers call “BadRAM,” the researchers managed to bypass the built-in security in AMD processors. The chipmaker was notified months ago and the problem was fixed.

Misleading communication

Researchers at KU Leuven have already managed to discover vulnerabilities in widespread IT infrastructures. For example, vulnerabilities in Intel processors have already become known. This time the researchers focused on the main competitor AMD and also took a different methodological approach by focusing on the communication between chip and memory.

The researchers found that communication via the SPD chip (Serial presence detection) allows manipulation. This chip informs the processor about the available memory when it starts. Using BadRAM technology, the researchers tricked the processor into giving the impression that there was more memory available than was actually the case

This gave them access to stored data and the ability to overwrite it. This way they could Secure encrypted virtualizationTechnology that protects sensitive data. AMD was informed of the issue in February, after which updates were developed and rolled out by cloud providers. There are therefore no longer any risks for end consumers.

Competition for security

The researchers fear that this will not be the last time they discover errors in Intel and AMD technology. Both companies are engaged in fierce competition, with AMD gradually nibbling away at Intel’s market share. Professor Jo Van Bulck warns that security is falling down the priority list in an attempt to maintain momentum.

“The increasing competition between AMD and Intel does not always seem to benefit the security of their systems. Both companies are placing increasing emphasis on speed and user-friendliness, which is of course also commercially attractive. As cybersecurity researchers, our job is to critically evaluate the latest technologies and uncover security risks that are often behind these speed increases,” says Van Bulck.