Yesterday, AMD and Google publicly disclosed September findings of a key microcode vulnerability in AMD Zen 1 to Zen 4 CPUs, specifically server/enterprise platform EPYC CPUs. This vulnerability, CVE-2024-56161, is discussed in more detail in the GitHub post from the Google Security Research team and, of course, AMD's security bulletin on the vulnerability.
According to Google's documentation, the original issue was reported on September 25, 2024, and subsequently fixed by AMD about two and a half months later, on December 17, 2024. The public disclosure date was delayed until yesterday, February 3, to give AMD's customers time to apply the fix before the issue became more widespread.
