Lenovo vendor locking Ryzen CPUs with AMD PSB
There are a couple of issues I see with this.<p>First, the security argument is nonsense in my opinion.
This &quot;feature&quot; only prevents an attacker from flashing a modified, malicious BIOS on to the server.<p>But: If an attacker manages to flash a new BIOS to your server, you&#x27;re already lost. That either requires physical access (which is bad), or access to the OOB &#x2F; BMC &#x2F; IPMI (which is equally bad, because those usually have a remote KVM feature, so you could e.g. boot the OS into recovery mode)<p>It does not prevent any other attacks, because you could still swap out the CPU. The servers usually just quietly burn the CPUs, so you wouldn&#x27;t notice if the CPUs were replaced by an attacker.<p>Second, this produces a lot of unnecessary e-waste. About 99% of all hardware (except HDDS) from datacenters is sold on the second hand market.
Locked CPUs are essentially worthlese, especially if buyers or sellers don&#x27;t know and throw the CPU away because they think it&#x27;s defective.<p>Third, this opens up a MASSIVE attack surface.
Imagine if somebody finds a bug im the PSP (Platform Security Processor, a CPU inside the CPU that handles the locking thing amon g other things) and is able to burn arbitrary keys into the CPU.
The attacker would randomly generate a key and burn them into the CPU.
You could permanently kill an entire datacenter with that within seconds.<p>Or if somebody manages to write a malicious BIOS version and flash it to servers which usually don&#x27;t have a locked BIOS. This BIOS version would also burn a random key into the CPU with the same result:
You can easily permanently destroy an entire datacenter.<p>I think this is just AMD&#x27;s greediness again in the cloak of &quot;improving security&quot;