×
all 16 comments
sorted by:
new (suggested)
besttopcontroversialoldq&a

[–]nyanpasu64 2 points3 points  (1 child)

I've figured out what's wrong with the auto updater.

In my opinion the following fixes need to be made:

  • Replace the 301 redirect with the contents of the file?
  • Change AMDAutoUpdate.exe to follow the redirect (does not fix existing installations of the updater which can't follow the redirect)
  • Edit versioninfo.xml to not supply downloads over HTTP URLs which can be intercepted and replaced with malware!!!

The only reason AMDAutoUpdate.exe isn't already an exploit vector is because it coincidentally fails to download a file with insecure links!

[–]theclevermen 0 points1 point  (0 children)

Nice work! I wonder if supplying the redirected versioninfo URL in config would change anything. Might test that later. As for http URLs in versioninfo - they redirect to https, so WebClient would still fail at this point. It's a shame that AMD didn't fix such a trivial issue for god knows how many years now

[–]shad0th 0 points1 point  (0 children)

I am seeing this too now, same entry in the log-file. I'm going to uninstall the software for now.

[–]lordunga 0 points1 point  (1 child)

This issue still exists in Feb 2025.

There is a AMDAutoUpdate scheduled task that launches it. At least in my case Ryzen Master is what's updating this task and it's run interval. Maximum is 365 days.

[–]Irreligious_PreacheR 0 points1 point  (0 children)

September 2025, still an issue.

[–]Daneel_Trevize 0 points1 point  (3 children)

In your Windows Security settings, Device security tab, do you have Core Isolation via VM support enabled, and then Memory integrity On?

[–]_SuriViruS_ 0 points1 point  (0 children)

Should it be On or why did you mention it?