[kwlug-disc] AMD microcode security update notice

[Chris Irwin]

On Fri, Jun 26, 2026 at 09:42:41AM -0400, Khalid Baheyeldin wrote:
>The puzzling part is this Entrysign thing mentioned in the text.
>How can I tell if a given machine's UEFI BIOS supports this feature or not?

Basically you need to check the AMD Platform Initialization/AGESA 
version, which is part of the system firmware.

Good news: Apparently Linux 7.1 will output AGESA version to the kernel 
log:

     https://www.phoronix.com/news/AMD-AGESA-Version-Linux-7.1

Bad news: Even Fedora is still on 7.0, so you probably don't have that.


>    For more details, refer to AMD-SB-7033:
>    https://www.amd.com/en/resources/product-security/bulletin/amd-sb-7033.html

Using my laptop as an example: Thinkpad Z13 Gen2, with a Ryzen 5 Pro 
7540U.

The AMD site said this is CVE-2024-36347, and the fixed version of AMD's 
PI (AGESA) for my platform is  CezannePI-FP6 1.0.1.1b (2024-12-27)

Again, there doesn't seem to be a way for me to look this up currently 
on my current kernel version, and Lenovo doesn't detail AGESA version in 
their BIOS changelogs.

Looking up Lenovo's listing for the above CVE, it says it was fixed in 
firmware 1.36 for my system:

     https://support.lenovo.com/us/en/product_security/LEN-189490

I have firmware 1.39, so I should be good.

     $ cat /sys/class/dmi/id/bios_version
     N41ET62W (1.39 )

Double-checking Lenovo's BIOS history for this device shows the 
CVE-2024-36347 was actually fixed in 1.35, not 1.36...

     https://download.lenovo.com/pccbbs/mobiles/n41ur16w.html

That also matches with the lvfs, which shows it was fixed in 1.35, but 
that was also marked as "may not be suitable for production systems". 
Not sure if that was a pre-release, a yanked release, or what.

     https://fwupd.org/lvfs/devices/com.lenovo.ThinkPadN41ET.firmware

Somewhat concerning that AMD had fixed platform code out 2024-12-27, and 
the fixed BIOS for my system didn't ship until 2025-09-09.

-- 
Chris Irwin

email:   chris at chrisirwin.ca
   web: https://chrisirwin.ca