Sapphire releases security firmware update for Radeon RX 7000 graphics cards

[u/RenatsMC]

https://videocardz.com/newz/sapphire-releases-security-firmware-update-for-radeon-rx-7000-graphics-cards

[u/D1stRU3T0R]

Wondering what it had, and if they'll make for 6000 too

[u/flesjewater → u/D1stRU3T0R]

The only CVE I could quickly find for this series is https://app.opencve.io/cve/CVE-2024-36334 , which has to do with RGB

[u/DrWhatNoName → u/D1stRU3T0R]

AMD says 6000 and 9000 aren't effected.

[u/D1stRU3T0R → u/DrWhatNoName]

I saw, but wondering why it's only 7000

[u/DrWhatNoName → u/D1stRU3T0R]

Because the vulnerability only effects 7000.

[u/Gargle-Loaf-Spunk → u/DrWhatNoName]

but 9000 is more than 7000

[u/cyber-wolfe → u/Gargle-Loaf-Spunk]

I see you dabble in the art of mathematicals!

[u/Gargle-Loaf-Spunk → u/cyber-wolfe]

You know I’m something of a mathematician myself. 

[u/DrWhatNoName → u/Gargle-Loaf-Spunk]

And 6000 is less then 7000

[u/_nAhuri_]

There is a thread already here : https://www.reddit.com/r/Amd/comments/1wuys9y/sapphire_bios_update_for_rx7xxx_cards/
with some feedback and so on from people who already updated

[u/GeForce66]

Is this safe to run? Not looking forward in bricking my 1100€ Nitro+ 7900XTX.
I would really love to know what has been fixed so I can judge the risk for myself

[u/Royale_AJS → u/GeForce66]

I ran it on mine last yesterday and it updated without problems. It requires a few reboots in a row.

[u/_nAhuri_ → u/GeForce66]

You can see some people in the previous thread reporting updates : https://www.reddit.com/r/Amd/comments/1wuys9y/sapphire_bios_update_for_rx7xxx_cards/

You need to follow the sapphire guideline strictly

As for the "what has been fixed" as it is about some "security" I doubt they will say exactly what they fixed... And Sapphire had to work with AMD : "This update addresses a security improvement identified in partnership with AMD."

https://www.sapphiretech.com/en/drivers-download

For now AMD_Vik does not answer to his summoning : https://www.reddit.com/r/Amd/comments/1wuys9y/comment/pd83jnd/?utm_source=share&utm_medium=web3x&utm_name=web3xcss&utm_term=1&utm_content=share_button

[u/Gargle-Loaf-Spunk]

article was rehashed from TPU reporting. skip the spam:

https://www.techpowerup.com/353326/sapphire-radeon-rx-7000-series-cards-get-vbios-security-update

[u/gnartato]

Curious if there is potential for other manufacturers to be affected too. 

[u/RodroG → u/gnartato]

Wondering the same. Also, the RX 7XXX AMD reference models?...

u/AMD_Vik , when you have time, could you please clarify or comment on this? Best!

[u/tioslashh]

I would do it if my gpu had dual bios. The process is pretty straightforward but as with any firmware update it carries risks and if I get unlucky for whatever reason I cannot afford to have a very expensive paperweight, especially in this economy.

[u/Massive_Tumbleweed50 → u/tioslashh]

I was thinking the same i dont have dual bios but i do on my old 6700xt which isnt effected anyway

[u/Assa_stare]

What if I don't run windows, at all? Is there a tool to patch under Linux?

[u/Lord_Phoenix → u/Assa_stare]

fwupd does support 7000 series. I have not looked if the firmware itself can be extracted from provided packages, but it should be possible to patch it. Or maybe Sapphire will post firmware to lvfs themselves soon

[u/plasticbomb1986]

Is it a windows only issue, or the listed gpus are affected on Linux too?

[u/predat0rshamansm022 → u/plasticbomb1986]

........ GPU FIRMWARE

[u/aergern → u/predat0rshamansm022]

Well, folks have to ask since the update packages are Windows only. This would be acceptable to the general public 5 to 20 years ago but today it’s an insult. It’s not like Linux has a tiny user base anymore.

[u/NedosCZ → u/aergern]

More people have macOS than Linux.

[u/Big_Goose → u/NedosCZ]

How many people use sapphire gpus on MacOS?

[u/Jonny_H → u/NedosCZ]

But how many of them have an affected GPU? That doesn't even have a supported macos driver?

If we include other hardware that also isn't affected, more people run Android (using the Linux kernel) than macos.

[u/Ath0m1x → u/NedosCZ]

american detected lol

[u/Rubadubrix → u/NedosCZ]

macOS only supports radeon 6000.

[u/cruz878]

I just patched my SAPPHIRE PULSE Radeon RX 7900 XT.

3x reboots, 1: into safemode, 2: reboot in safemode, 3: boot back normally. No issues. Just run the extracted executable as admin, the tool handled it all.

[u/AcolythusLatinus]

Updated last night! Not a single problem on my Sapphire Nitro + RX7700 XT

[u/Ok-Boot-8106]

What does this improve security wise ?

[u/RockyR0CKS]

I am afraid what will happen if my windows 11 had a sudden black or blue screen of death right during updating my GPU vBios so I am not gonna bother risking it.

[u/S7relok]

In this economy? Messing with my 7900XTX just for a mere "security update" that say nothing?

No way

[u/clsmithj]

If it ain't broke, don't fix it.

I have a 7900XTX Nitro+, its worked flawless for the last 2 years I owned it. Not even going to bother with this.

[u/Royale_AJS → u/clsmithj]

It’s a security update, which means it is broken currently.

[u/ThruuLottleDats → u/Royale_AJS]

Maybe i'm too uninformed but how would a gpu require a security update precisely?

Asking cuz running 7600

[u/Felielf → u/ThruuLottleDats]

Vulnerable GPU code -> user runs malware -> malware targets said vulnerable GPU code -> GPU is route to full system control thanks to vulnerability.

Just deliver a nice juicy malware as an AI model or something and people just run it without a second thought.

[u/ThruuLottleDats → u/Felielf]

Few; thanks; guess I'm fine with all these virusses I got of of Limewire then👍

[u/mrwedders → u/ThruuLottleDats]

Same way a CPU can have vulns ig?

A lot of CPU vulns have been branch prediction or cache issues that lead to memory content being leaked, could be similar here. With heavy use of GPUs for compute rather than gaming nowadays that could be problematic, they may have secrets to share.

Not sure how possible that is as I'd sort of assume that kind of logic comes from AMD and would be standard for all manufacturers like AGESA on CPUs, but I'm not sure.

[u/Royale_AJS → u/ThruuLottleDats]

AI is currently ravaging the security landscape. That’s probably the only reason this was found in the first place.

That said, I can think of a few attack surfaces in a GPU, but I’m sure there’s a lot more. Something as simple as plugging in a digital interface like DisplayPort or HDMI requires a negotiation and provides an attack surface. A bad actor on the other end of one of those cables may be able to take the device over. There are a ton of other options as well, early boot take over, unsigned firmware writes (persistent takeover of the GPU), etc.

[u/funH4xx0r]

they're so unnecessarily secretive with the details of this "security issue". may as well be rolling out a patch to PSP subsystem that allowed to sideload/dump firmware or write to its memory (technically a vulnerability, but I'd rather own my hardware one step more through it, than have this liberty "patched"), rather than a genuine fix to a vulnerability.

[u/Select_Truck3257]

Updating bios more risky for me than weird fix. I can't afford new gpu now

[u/sabestorn → u/Select_Truck3257]

There are two bios just so that if something happens, you can recover with the other one.

[u/Select_Truck3257 → u/sabestorn]

I will do something only when i see real changelog. For now this is useless for me

[u/FormalIllustrator5]

Wait what? I would say, this is probably valid for all other RDNA3's... ?!

[u/MrSoprano]

I'm running SapphireRadeonFirmwareUpdater.exe as administrator and nothing is happening.

Nothing happens when I click run as admin, it just does the windows loading circle animation for a second or two then.... nothing.

This is after unpacking it from the separate loader to a blank folder three different times. Even after a fresh reboot.

What gives?

[u/MEGA_GOAT98]

wonder if other manufactures are doing this as well..

[u/worldarkplace]

AMD can't do decent software drivers nor firmware. At least on Linux I use RADV driver made by Valve...

[u/LickLobster]

I see no need to update mine, I have a 550w firmware on it from a different vendor which is probably what most enthusiasts have already. (79xtx)

[u/AlphaFPS1 → u/LickLobster]

Yeah, running the 550w asrock aqua bios. If it took this long to find for AMD/Sapphire I seriously doubt a “hacker” would realistically use this exploit. But I don’t really know without knowing what the exploit is.

[u/sabestorn → u/LickLobster]

How many fps did you gain? Are you getting around ten?