AMD discloses slew of high severity security vulnerabilities for Zen systems that attacks BIOS chips — updates aren’t available for all chips, finally a fix Zenbleed

AMD has disclosed four vulnerabilities found in its Zen-based CPUs, ranging from the original Zen chips to the latest Zen 4 processors, and not all impacted chips have a readily available BIOS version to correct the issue. The vulnerabilities, which compromise the security of the SPI interface that connects to the flash chip that stores your BIOS, affect different generations of different Zen CPUs — not all processors are vulnerable to all four bugs. AMD is patching the vulnerabilities through new versions of AGESA, which is the base code for motherboard BIOSes. However, not all motherboard vendors have released new updates with the patched AGESA.

Though distinct, the four vulnerabilities hinge on the SPI interface that connects the CPU to the chip on the motherboard where the system firmware is stored. Exploiting these vulnerabilities could allow hackers to perform denial of service attacks, escalate privileges, and even execute arbitrary code. That last one can be particularly scary, as arbitrary code execution essentially means tricking a computer into running code, and that code could really be anything.