AMD has commented on the vBIOS updates that Sapphire and Gigabyte have recently pushed out for their Radeon RX 7000 series graphics cards, although the company stopped short of revealing exact details. It seems that whatever flaw has been discovered may not be exclusive to one brand, so other partner cards based on these GPUs may receive patches as well.
10 days ago, Sapphire published a vBIOS update for AMD’s RDNA 3 Radeon RX 7000 series graphics cards. This update covered all desktop GPUs, from the entry-level RX 7600 to the flagship RX 7900 XTX. While users could download and install the vBIOS, Sapphire didn’t specifically share what fixes it brought, citing vague security issues identified in partnership with AMD.
Gigabyte, on the other hand, shared one extra bit of information alongside its vBIOS announcement, indicating that the vulnerabilities in question are identified under the AMD-SN-6023 reference. Unfortunately, this reference isn’t yet listed on AMD’s product security page.
Considering that GPU vBIOS updates have become a rare occurrence nowadays, German tech outlet ComputerBase contacted Sapphire for more details. The latter shared the following [translated] statement from AMD:
“As part of our standard procedure, AMD is releasing a firmware update to address potential security vulnerabilities. These fixes are provided ahead of public disclosure to give customers time to update their firmware. As a best practice, we recommend users update the firmware of their graphics cards as soon as it is made available by their respective GPU manufacturer. There are no reports of these vulnerabilities being exploited in practice.”
While AMD didn’t disclose the severity of these vulnerabilities and the conditions required to exploit them, the most important part is that they haven’t been exploited yet. As for why the details are secret, this is standard industry practice to give partners and users enough time to update and protect their systems ahead of the reveal. If details leak beforehand, bad actors could take advantage of these flaws to build sophisticated attacks.
While it’s unclear if other brands are impacted by these vulnerabilities, if both Gigabyte and Sapphire are sensitive, other AMD partners’ cards may well be affected too.
If you own a Sapphire Radeon RX 7000 series graphics card and want to update its vBIOS, you can download and follow this step-by-step PDF guide from Sapphire here. The process seems fairly easy, mainly consisting of downloading the specific file for your GPU, then running it in Administrator mode and letting it do its job. The tool will detect if any AMD GPU is present and indicate if there is a new firmware version. After finishing, you can confirm the new firmware has been installed by going into your Adrenalin Software driver app.
