-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Format: 1.8 Date: Sun, 01 Nov 2026 22:30:40 -0300 Source: amd64-microcode Architecture: source Version: 3.20260923.1 Distribution: unstable Urgency: medium Maintainer: Henrique de Moraes Holschuh <hmh@debian.org> Changed-By: Henrique de Moraes Holschuh <hmh@debian.org> Closes: 1124123 1151714 Changes: amd64-microcode (3.20260923.1) unstable; urgency=medium . * Update package data from linux-firmware 20261101 * Update AMD-SEV firmware for most EPYC processors (20260623) * ATTENTION: the AMD-SEV firmware updates require reasonably up-to-date firmware components, and it will NOT work on any systems with an outdated BIOS that are still vulnerable to "Entrysign" * SECURITY UPDATE, refer to AMD-SB-3023 for details; CVE-2025-29939, CVE-2025-48509, CVE-2025-0031, CVE-2025-52536, CVE-2024-21953, CVE-2025-29946, CVE-2025-29948, CVE-2025-29952, CVE-2025-48517, CVE-2025-52536, CVE-2025-48509, CVE-2025-0029. Note: may disable SEV-ES when SEV-SNP is enabled in some processors. * SECURITY UPDATE (AMD-SB-3020, CVE-2025-0033): Improper access control within AMD SEV-SNP could allow an admin privileged attacker to write to the RMP during SNP initialization, potentially resulting in a loss of SEV-SNP guest memory integrity. + Updated SEV firmware: + Family 17h models 00h-0fh: version 0.17 build 49 + Family 17h models 30h-3fh: version 0.24 build 22 + Family 19h models 00h-0fh: version 1.58 build 01 + Family 19h models 10h-1fh: version 1.58 build 02 + Family 19h models a0h-afh: version 1.58 build 03 + Family 1ah models 00h-0fh: version 1.58 build 06 * Update AMD EPYC processor microcode (20260923) (closes: #1151714) + SECURITY UPDATE (AMD-SEV), refer to AMD-SB-3023 for details; CVE-2025-48514, CVE-2025-54514, CVE-2025-0012, CVE-2025-52534. * Updated Microcode patches: + Family=0x1a Model=0x02 Stepping=0x01: Patch=0x0b00217b Length=14368 bytes + Family=0x1a Model=0x11 Stepping=0x00: Patch=0x0b101068 Length=14368 bytes * NEWS.Debian: update for AMD-SEV that requires post-Entrysign firmware * initramfs: install AMD-TEE firmware into the initramfs (closes: #1124123) * debian/changelog: update 3.20251202.1 entry with security update details that were recently disclosed. * debian/changelog: update 3.20251202.1 entry with list of new and updated microcode patches. Checksums-Sha1: a9a4419b182840ad9e312efec7c2d9c54291f35d 1716 amd64-microcode_3.20260923.1.dsc a3d04a2a803de01b1c170a780ddcecd35debabe6 511104 amd64-microcode_3.20260923.1.tar.xz 11c54230d7cf16e06145bfed6b1ef03454993054 5720 amd64-microcode_3.20260923.1_amd64.buildinfo Checksums-Sha256: 0940ec73663cce20b64ac46b9ac70e0e29f6ef973a2f6f5c2e27bc76a8c90b64 1716 amd64-microcode_3.20260923.1.dsc 5a777601c427bf4b602ff8ce4d6a64da2ea82d285149a9579d73ccd35b6c23a0 511104 amd64-microcode_3.20260923.1.tar.xz 1f596dd02e2f26c583c0057c2c8f8bfd9a58ebfa3a10f1ff2aa97868574f9b76 5720 amd64-microcode_3.20260923.1_amd64.buildinfo Files: f15a0d86a70153731d98e02af517ea8b 1716 non-free-firmware/admin standard amd64-microcode_3.20260923.1.dsc ab673a08444343d94012ecf2d13dc6cd 511104 non-free-firmware/admin standard amd64-microcode_3.20260923.1.tar.xz 6398a94a0d9cbed45972977d361de47e 5720 non-free-firmware/admin standard amd64-microcode_3.20260923.1_amd64.buildinfo -----BEGIN PGP SIGNATURE----- iQJDBAEBCgAtFiEEXkgBOZUzqFl7sZ7ad6rEp8yOnQsFAmrn7PwPHGhtaEBkZWJp YW4ub3JnAAoJEHeqxKfMjp0LBt8P/2MrY93QuoYv5NDY+uXzEXw/7fsAgGVXKuIV NCvPjglEaXil54GhuJLAsbU1YggWqoV7VwtgS6DGaWc1MMMOzZ18wMeRU1yNdrs3 bgI80YBDKfFUl1UT2BRu6jCCLccFBySTz2DF9rtVeyBY8VW+t2UrDUfAwvVUdRxE ng338BFBYrK5K64w/X6GrHRfDHXv9MbzPqPWN+OeRu0AWRz5DlbMgp5JZ8nbaL63 usW2OOsJ+Cg7XMpg9qTjXZiPoPkwyf+6w8q9+znXnhhm6NPrsV9jk8FsClYZ0m6X G+dMfQ9uI9j3tNmQ2Fj9ZlCFlH5CfqTDAZPBFxB/i672laGP+Lx5zrWOujNNYk7G muJbIEpnL6AKnY7Jp6vfwxIol5IzjN6TK+Kh4tWKPBKKemxDeHgexq3Cc3Cy98eM 3U3us/HKtFr5O82hgJOv4suEn7umuUwrUFkjhy7O71LYYQlZwCmYbnFCQU3ui1IK 5PHbgtB/X0Lgs316K4gl+AK+gHuxRMPlQwg93xeU2RGHL+zWf23XGrDaZu3Bahco ZyGITGgRJQkN6w/pWQlKJ60PzAfoE3yz98Qw61Wc/Zcqc/kMnWR/fwKq7H0gkgy8 0LaK+YOUyZ9SBjw8IyMViV3ZZeBswkP+HQj39sM7U2Fs8XyC/8iCKG1iVjmE0jTv 6EF1P8RG =BbAN -----END PGP SIGNATURE-----
