Thomas Fricke (he/him)<p><a href="https://23.social/tags/e2ee" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>e2ee</span></a> <a href="https://23.social/tags/e2eencryption" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>e2eencryption</span></a> </p><p>AMD: Microcode Signature Verification Vulnerability</p><p>"... security vulnerability in some AMD Zen-based CPUs. This vulnerability allows an adversary with local administrator privileges (ring 0 from outside a VM) to load malicious microcode patches."</p><p><a href="https://github.com/google/security-research/security/advisories/GHSA-4xq7-4mgh-gp6w" rel="nofollow noopener noreferrer" translate="no" target="_blank"><span class="invisible">https://</span><span class="ellipsis">github.com/google/security-res</span><span class="invisible">earch/security/advisories/GHSA-4xq7-4mgh-gp6w</span></a></p><p>This is exactly the attack against which <a href="https://23.social/tags/confidentialcomputing" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>confidentialcomputing</span></a> should protect us</p><p>And it won't, when the attacker has access to ring0 of the hardware. Everywhere you don't run yourself.</p><p><a href="https://23.social/tags/cloud" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>cloud</span></a></p>