AMD’s next-gen Zen 5 APUs appear — Strix Point and Strix Halo listed in ROCm Code with RDNA 3.5 GPU
January 24, 2024
Arm unveils next-gen Neoverse CPU cores and compute subsystems — hoping to entice more custom silicon customers
February 22, 2024
Update your BIOS ASAP.
AMD has disclosed four vulnerabilities found in its Zen-based CPUs, ranging from the original Zen chips to the latest Zen 4 processors, and not all impacted chips have a readily available BIOS version to correct the issue. The vulnerabilities, which compromise the security of the SPI interface that connects to the flash chip that stores your BIOS, affect different generations of different Zen CPUs — not all processors are vulnerable to all four bugs. AMD is patching the vulnerabilities through new versions of AGESA, which is the base code for motherboard BIOSes. However, not all motherboard vendors have released new updates with the patched AGESA.
Though distinct, the four vulnerabilities hinge on the SPI interface that connects the CPU to the chip on the motherboard where the system firmware is stored. Exploiting these vulnerabilities could allow hackers to perform denial of service attacks, escalate privileges, and even execute arbitrary code. That last one can be particularly scary, as arbitrary code execution essentially means tricking a computer into running code, and that code could really be anything. However, any attack would require local access to the affected system, meaning that it would take an especially vigilant attacker to exploit the vulnerability.
| Processor Series | Patched AGESA | Availability to OEMs |
| Ryzen 3000 | ComboAM4v2PI 1.2.0.B | Since August 25 |
| Ryzen 3000 Mobile | PicassoPI-FP5 1.0.1.0 | Since May 31 |
| Athlon 3000 | ComboAM4v2PI 1.2.0.B | Since August 25 |
| Ryzen 4000 | RenoirPI-FP6 1.0.0.D | Target February |
| Ryzen 4000G | ComboAM4v2PI 1.2.0.C | Since February 7 |
| Ryzen 5000 | ComboAM4v2PI 1.2.0.B | Since August 25 |
| Ryzen 5000G | ComboAM4v2PI 1.2.0.C | Since February 7 |
| Ryzen 5000 Mobile | CezannePI-FP6 1.0.1.0 | Since January 25 |
| Ryzen 6000/7035 | RembrandtPI-FP7 1.0.0.A | Since December 28 |
| Ryzen 7000 | ComboAM5PI 1.0.0.8 | Since August 29 |
| Ryzen 7020 | MendocinoPI-FT6 1.0.0.6 | Since January 3 |
| Ryzen 7040 | PhoenixPI-FP8-FP7 1.1.0.0 | Since October 6 |
| Ryzen 7045 | DragonRangeFL1PI 1.0.0.3b | Since August 30 |
The latest AGESA versions from months ago also protect Epyc CPUs, and Threadripper received its AGESA update in January. Threadripper 7000, however, isn't mentioned in the disclosure, which may mean AMD learned of the vulnerabilities in time to ensure its latest HEDT CPUs never shipped with a buggy AGESA. Only two of AMD's embedded CPUs don't yet have a secure AGESA, which is scheduled to arrive in April.
| Processor Series | Patched AGESA | Availability to OEMs |
| 1st Gen Epyc | NaplesPI 1.0.0.K | Since April 27 |
| 2nd Gen Epyc | RomePI 1.0.0.H | Since November 11 |
| 3rd Gen Epyc | MilanPI 1.0.0.C | Since December 18 |
| 4th Gen Epyc | GenoaPI 1.0.0.8 | Since June 9 |
| Threadripper 3000 | CastlePeakPI-SP3r3 1.0.0.A | Since November 21 |
| Threadripper Pro 3000WX | CastlePeakWSPI-sWRX8 1.0.0.C | Since November 29 |
| Threadripper Pro 5000WX | ChagallWSPI-sWRX8 1.0.0.7 | Since January 11 |
| Epyc Embedded 3000 | Snowyowl PI 1.1.0.B | Since December 15 |
| Epyc Embedded 7002 | EmbRomePI-SP3 1.0.0.B | Since December 15 |
| Epyc Embedded 7003 | EmbMilanPI-SP3 1.0.0.8 | Since January 15 |
| Epyc Embedded 9003 | EmbGenoaPI-SP5 1.0.0.3 | Since September 15 |
| Ryzen Embedded R1000 | EmbeddedPI-FP5 1.2.0.A | Since July 31 |
| Ryzen Embedded R2000 | EmbeddedPI-FP5 1.0.0.2 | Since July 31 |
| Ryzen Embedded 5000 | EmbAM4PI 1.0.0.4 | Since September 22 |
| Ryzen Embedded V1000 | EmbeddedPI-FP5 1.2.0.A | Since July 31 |
| Ryzen Embedded V2000 | EmbeddedPI-FP6 1.0.0.9 | Target April |
| Ryzen Embedded V3000 | EmbeddedPI-FP7r2 1.0.0.9 | Target April |
Of course, new AGESA versions have to be distributed via new BIOS versions, which means even if a new AGESA is technically available, it could be a while before it reaches motherboards. For Epyc, embedded, and mobile CPUs, it's difficult to say how many motherboards offer a BIOS with the latest AGESA version, but for consumer Ryzen and Threadripper boards, this info is far more available and easier to find. We've looked at desktop motherboards from the big four vendors, and here's how they stand when it comes to AGESA versions.
| Row 0 - Cell 0 | 300 Series | 400 Series | 500 Series | TRX40 | WRX80 | 600 Series |
| Asus | ComboAM4v2PI 1.2.0.A | ComboAM4v2PI 1.2.0.B | ComboAM4v2PI 1.2.0.B | CastlePeakPI-SP3r3 1.0.0.7 | ChagallPI-SP3r3 1.0.0.5 | ComboAM5PI 1.1.0.2b |
| ASRock | ComboAM4v2PI 1.2.0.B | ComboAM4v2PI 1.2.0.B | ComboAM4v2PI 1.2.0.B | CastlePeakPI-SP3r3 1.0.0.9 | ChagallPI-SP3r3 1.0.0.6 | ComboAM5PI 1.1.0.2b |
| Gigabyte | ComboAM4v2PI 1.2.0.B | ComboAM4v2PI 1.2.0.B | ComboAM4v2PI 1.2.0.B | CastlePeakPI-SP3r3 1.0.0.7 | ChagallPI-SP3r3 1.0.0.6 | ComboAM5PI 1.1.0.2b |
| MSI | ComboAM4v2PI 1.2.0.A | ComboAM4v2PI 1.2.0.A | ComboAM4v2PI 1.2.0.B | CastlePeakPI-SP3r3 1.0.0.4 | Unknown, but unpatched | ComboAM5PI 1.1.0.2b |
* Not a comprehensive list and may not be true for all motherboards
AM5 motherboards are seemingly completely patched for the four vulnerabilities, which means computers using Ryzen 7000 and Ryzen 8000 chips should be fine. As mentioned previously, AMD didn't make any disclosures for Threadripper 7000, which should mean TRX50 and WRX90 motherboards are also in the clear.
Unfortunately, for users of AMD's last-generation sockets, updates haven't been as rapid as they have been for AM5. As far as we could tell, no AM4 motherboards thus far offer a BIOS using AGESA version 1.2.0.C, which means Ryzen 4000G and 5000G APUs are vulnerable no matter who your motherboard maker is. AGESA version 1.2.0.B is broadly available on every 500 series board from the four big vendors, but the same can't be said for the 300 and 400 series. Asus's and MSI's 300 series boards are still on version 1.2.0.A, as are MSI's 400 series boards.
Meanwhile, TRX40 for the Threadripper 3000 series is mostly safe, except MSI hasn't updated its TRX40 boards since version 1.0.0.4. However, it seems Threadripper Pro 3000WX and 5000WX have gotten the short end of the stick by far, as the WRX80 socket is completely vulnerable no matter what vendor you're with. Hopefully, this is just because the AGESA versions haven't been out for very long.