<story><title>Lenovo vendor locking Ryzen CPUs with AMD PSB</title><url>https://www.servethehome.com/lenovo-vendor-locking-ryzen-cpus-with-amd-psb-the-video/</url></story><parent_chain></parent_chain><comment><author>alerighi</author><text>The problem is the AMD PSB functionality in itself. It should be considered malware like the Intel managament engine and thus refused by users. It&amp;#x27;s a second processor that runs a proprietary firmware signed by the vendor (that the user cannot modify or substitute entirely with a FLOSS alternative) that vendors can use do harm to the user.&lt;p&gt;The AMD PSB can also be used to lock down a processor to enforce secure boot and thus don&amp;#x27;t let you run an unsigned operating system, i.e. no longer allowing you to run Linux on your machine that comes out of the factory with Windows preinstalled. That would be a very very bad thing.&lt;p&gt;Unfortunately both for Intel and AMD you don&amp;#x27;t have choices these days. I&amp;#x27;m hoping someone develops a processor based on the RISCV architecture (a free architecture that doesn&amp;#x27;t include that shit) to be used in a computer entirely under the control of the user (hardware and software) and not the corporation that makes it.</text></comment>
<story><title>Lenovo vendor locking Ryzen CPUs with AMD PSB</title><url>https://www.servethehome.com/lenovo-vendor-locking-ryzen-cpus-with-amd-psb-the-video/</url></story><parent_chain></parent_chain><comment><author>NablaSquaredG</author><text>There are a couple of issues I see with this.&lt;p&gt;First, the security argument is nonsense in my opinion.
This &amp;quot;feature&amp;quot; only prevents an attacker from flashing a modified, malicious BIOS on to the server.&lt;p&gt;But: If an attacker manages to flash a new BIOS to your server, you&amp;#x27;re already lost. That either requires physical access (which is bad), or access to the OOB &amp;#x2F; BMC &amp;#x2F; IPMI (which is equally bad, because those usually have a remote KVM feature, so you could e.g. boot the OS into recovery mode)&lt;p&gt;It does not prevent any other attacks, because you could still swap out the CPU. The servers usually just quietly burn the CPUs, so you wouldn&amp;#x27;t notice if the CPUs were replaced by an attacker.&lt;p&gt;Second, this produces a lot of unnecessary e-waste. About 99% of all hardware (except HDDS) from datacenters is sold on the second hand market.
Locked CPUs are essentially worthlese, especially if buyers or sellers don&amp;#x27;t know and throw the CPU away because they think it&amp;#x27;s defective.&lt;p&gt;Third, this opens up a MASSIVE attack surface.
Imagine if somebody finds a bug im the PSP (Platform Security Processor, a CPU inside the CPU that handles the locking thing amon g other things) and is able to burn arbitrary keys into the CPU.
The attacker would randomly generate a key and burn them into the CPU.
You could permanently kill an entire datacenter with that within seconds.&lt;p&gt;Or if somebody manages to write a malicious BIOS version and flash it to servers which usually don&amp;#x27;t have a locked BIOS. This BIOS version would also burn a random key into the CPU with the same result:
You can easily permanently destroy an entire datacenter.&lt;p&gt;I think this is just AMD&amp;#x27;s greediness again in the cloak of &amp;quot;improving security&amp;quot;</text></comment>