Zenbleed and Downfall: firmware updates count too
Two new CPU bugs can leak data between programs. The fix is BIOS and microcode updates, which many teams skip.
Two serious CPU bugs this summer: Zenbleed in AMD’s Zen 2 processors, and Downfall in many Intel generations. Both can let one program read data it shouldn’t, such as passwords or keys from another program, or another virtual machine on the same server.
Most teams patch Windows and Linux every month. Far fewer update BIOS and CPU microcode, and that’s where these fixes live.
What to do:
- Servers first, especially hosts running virtual machines for different customers or teams. Check your vendor’s BIOS and firmware updates.
- Install OS updates too. Linux distributions and Windows ship microcode and workarounds.
- Cloud servers: the provider patches the physical hosts. You still update your own operating system.
- Watch performance after the Downfall fix on workloads that are heavy on certain instructions. Test before rolling out everywhere.
- Laptops and desktops: use the vendor’s update tool, or your device management, to push firmware.
Firmware is software. It needs updates like everything else.