Skip to main content

Stack Exchange Network

Stack Exchange network consists of 183 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

You are not logged in. Your edit will be placed in a queue until it is peer reviewed.

We welcome edits that make the post easier to understand and more valuable for readers. Because community members review edits, please try to make the post substantially better than how you found it, for example, by fixing grammar or adding additional resources and hyperlinks.

Required fields*

Required fields*

How to do AMD CPU microcode update (not BIOS update)?

Yesterday, I updated my UEFI/BIOS to the latest version (about 11 days old only).

Summary of my HW/OS:

# hostnamectl | grep -v ' ID'

 Static hostname: rog-g713pi
 Pretty hostname: ASUS ROG Strix G17 G713PI-LL044W
       Icon name: computer-laptop
         Chassis: laptop 💻
      Deployment: production
Operating System: Linux Mint 22.2
          Kernel: Linux 6.14.0-33-generic
    Architecture: x86-64
 Hardware Vendor: ASUSTeK COMPUTER INC.
  Hardware Model: ROG Strix G713PI_G713PI
Firmware Version: G713PI.336
   Firmware Date: Wed 2025-10-01
    Firmware Age: 1w 4d

Immediately after the BIOS update, I downloaded and ran a very popular script to intended to check CVEs mitigation status, if you wish, you can download it from GitHub here.

/root/spectre-meltdown-checker.sh --paranoid

with all-green result, no CVE can be exploited at this point according to the script.

But, since I ran it multiple times, and also with --update-builtin-fwdb option to update the CPU fw database, re-running it afterward, it says:

* CPU microcode is the latest known available version:  NO  (latest version is 0xa60120c dated 2024/11/10 according to local firmwares DB v344+i20250812+9d6d)

My laptop CPU in question is AMD Ryzen 9 7845HX, and I do have amd64-microcode package installed, as well as linux-firmware package.

The only lines mentioned in dmesg are these two:

# dmesg | grep microcode

[Sat Oct 11 21:03:36 2025] microcode: Current revision: 0x0a601209
[Sat Oct 11 21:03:36 2025] microcode: Updated early from: 0x0a601209

and

# grep microcode -m 1 /proc/cpuinfo

microcode   : 0xa601209

Since I never dealt with this, I want to ask if there possibly is some way to update CPU microcode without waiting for another newer BIOS, which may not come soon?

So, is there some mechanism to update CPU microcode manually? And if so, does it pose any risk?

Thank you.

Answer*

Reminder: Answers generated by AI tools are not allowed due to Unix & Linux Stack Exchange's artificial intelligence policy

Cancel
5
  • 1
    The signing key for AMD Zen 1-4 cpus has leaked , meaning AMD CPUs between at least 2017-2022 are vulnerable to malicious microcode updates.
    hanshenrik
    –  hanshenrik
    2025-10-13 10:45:42 +00:00
    Commented yesterday
  • 1
    actually seems Zen 5 is also affected, cpus up to 2025-03-04 seems to be affected: github.com/google/security-research/security/advisories/… - conflicting reports, some places say Zen 1-4, but the github advisory page also mention Zen 5 and "PI < 2025-03-04" 🤔
    hanshenrik
    –  hanshenrik
    2025-10-13 10:53:30 +00:00
    Commented yesterday
  • Ah, good to know, thanks @hanshenrik!
    Stephen Kitt
    –  Stephen Kitt
    2025-10-13 10:57:30 +00:00
    Commented yesterday
  • 1
    It's not that the signing key has been leaked; rather, there's a flaw in the signature verification procedure that lets an attacker create additional keypairs that will be accepted as valid.
    Mark
    –  Mark
    2025-10-14 01:13:20 +00:00
    Commented 17 hours ago
  • @Mark Both, it seems. quote We were then able to recover the Zen 5 key on March 7, 2025 and reported this to AMD. We then jointly added Zen 5 to the list of affected products to our advisories on April 7, 2025.
    hanshenrik
    –  hanshenrik
    2025-10-14 08:58:41 +00:00
    Commented 9 hours ago

Morty Proxy This is a proxified and sanitized view of the page, visit original site.