Here we are - 3600 which was still under manufacture 2-3 years ago are not get patched. Shame on you AMD, if it is true.
What I mean by that is that they will take a huge disservice to their customers over a slight financial inconvenience (packaging and validating an existing fix for different CPU series with the same architecture).
I don’t classify fixing critical vulnerabilities from products as recent as the last decade as “goodwill”, that’s just what I’d expect to receive as a customer: a working product with no known vulnerabilities left open. I could’ve bought a Ryzen 3000 CPU (maybe as part of cheap office PCs or whatever) a few days ago, only to now know they have this severe vulnerability with the label WONTFIX on it. And even if I bought it 5 years ago: a fix exists, port it over!
I know some people say it’s not that critical of a bug because an attacker needs kernel access, but it’s a convenient part of a vulnerability chain for an attacker that once exploited is almost impossible to detect and remove.
Maybe they’ll reverse course with enough blowback, they did that once with ryzen already, don’t remember which Gen it was but it wasn’t going to be backwards compatible with certain type of mobos, but then they released it anyway and some mobo manufacturers did provide bios updates to support it.
Similarish situation could happen here, the biggest hangup I’d think is that the 3000 series is nearly 5 years old, and getting mobo manufacturers on board for that could be difficult.
