diff -Nru openssl-1.0.2g/debian/changelog openssl-1.0.2g/debian/changelog
--- openssl-1.0.2g/debian/changelog	2017-01-30 09:00:43.000000000 -0500
+++ openssl-1.0.2g/debian/changelog	2017-04-27 20:36:36.000000000 -0400
@@ -1,3 +1,11 @@
+openssl (1.0.2g-1ubuntu11.1) zesty; urgency=medium
+
+  * crypto/x86*cpuid.pl: move extended feature detection. (LP: #1674399)
+    This fix moves extended feature detection past basic feature 
+    detection where it belongs. 32-bit counterpart is harmonized too.
+
+ -- Eric Desrochers <eric.desrochers@canonical.com>  Thu, 27 Apr 2017 20:36:21 -0400
+
 openssl (1.0.2g-1ubuntu11) zesty; urgency=medium
 
   * SECURITY UPDATE: Montgomery multiplication may produce incorrect
diff -Nru openssl-1.0.2g/debian/patches/move-extended-feature-detection.patch openssl-1.0.2g/debian/patches/move-extended-feature-detection.patch
--- openssl-1.0.2g/debian/patches/move-extended-feature-detection.patch	1969-12-31 19:00:00.000000000 -0500
+++ openssl-1.0.2g/debian/patches/move-extended-feature-detection.patch	2017-04-27 20:44:05.000000000 -0400
@@ -0,0 +1,133 @@
+Description: Extended feature flags were not pulled on AMD processors, as result a number of extensions were effectively masked on AMD Ryzen CPU.
+ This fix moves extended feature detection past basic feature detection where it belongs. 32-bit counterpart is harmonized too.
+Author: Andy Polyakov <appro@openssl.org>
+Origin: https://github.com/openssl/openssl/commit/f8418d87e191e46b81e1b9548326ab2876fa0907 and https://github.com/openssl/openssl/commit/1aed5e1ac28790cc915ad03e86e2d5e896a4ea13
+Bug: https://github.com/openssl/openssl/issues/2848
+Bug-Ubuntu: https://launchpad.net/bugs/1674399
+--- a/crypto/x86_64cpuid.pl
++++ b/crypto/x86_64cpuid.pl
+@@ -59,7 +59,7 @@
+ 	mov	%rbx,%r8		# save %rbx
+ 
+ 	xor	%eax,%eax
+-	mov	%eax,8(%rdi)		# clear 3rd word
++	mov	%eax,8(%rdi)		# clear extended feature flags
+ 	cpuid
+ 	mov	%eax,%r11d		# max value for standard query level
+ 
+@@ -127,14 +127,6 @@
+ 	shr	\$14,%r10d
+ 	and	\$0xfff,%r10d		# number of cores -1 per L1D
+ 
+-	cmp	\$7,%r11d
+-	jb	.Lnocacheinfo
+-
+-	mov	\$7,%eax
+-	xor	%ecx,%ecx
+-	cpuid
+-	mov	%ebx,8(%rdi)
+-
+ .Lnocacheinfo:
+ 	mov	\$1,%eax
+ 	cpuid
+@@ -164,6 +156,15 @@
+ 	or	%ecx,%r9d		# merge AMD XOP flag
+ 
+ 	mov	%edx,%r10d		# %r9d:%r10d is copy of %ecx:%edx
++
++	cmp     \$7,%r11d
++	jb      .Lno_extended_info
++	mov     \$7,%eax
++	xor     %ecx,%ecx
++	cpuid
++	mov     %ebx,8(%rdi)            # save extended feature flags
++.Lno_extended_info:
++
+ 	bt	\$27,%r9d		# check OSXSAVE bit
+ 	jnc	.Lclear_avx
+ 	xor	%ecx,%ecx		# XCR0
+--- a/crypto/x86cpuid.pl
++++ b/crypto/x86cpuid.pl
+@@ -22,10 +22,10 @@
+ 	&pop	("eax");
+ 	&xor	("ecx","eax");
+ 	&xor	("eax","eax");
++	&mov    ("esi",&wparam(0));
++	&mov    (&DWP(8,"esi"),"eax");  # clear extended feature flags
+ 	&bt	("ecx",21);
+ 	&jnc	(&label("nocpuid"));
+-	&mov	("esi",&wparam(0));
+-	&mov	(&DWP(8,"esi"),"eax");	# clear 3rd word
+ 	&cpuid	();
+ 	&mov	("edi","eax");		# max value for standard query level
+ 
+@@ -83,26 +83,16 @@
+ 	&jmp	(&label("generic"));
+ 	
+ &set_label("intel");
+-	&cmp	("edi",7);
+-	&jb	(&label("cacheinfo"));
+-
+-	&mov	("esi",&wparam(0));
+-	&mov	("eax",7);
+-	&xor	("ecx","ecx");
+-	&cpuid	();
+-	&mov	(&DWP(8,"esi"),"ebx");
+-
+-&set_label("cacheinfo");
+ 	&cmp	("edi",4);
+-	&mov	("edi",-1);
++	&mov	("esi",-1);
+ 	&jb	(&label("nocacheinfo"));
+ 
+ 	&mov	("eax",4);
+ 	&mov	("ecx",0);		# query L1D
+ 	&cpuid	();
+-	&mov	("edi","eax");
+-	&shr	("edi",14);
+-	&and	("edi",0xfff);		# number of cores -1 per L1D
++	&mov	("esi","eax");
++	&shr	("esi",14);
++	&and	("esi",0xfff);		# number of cores -1 per L1D
+ 
+ &set_label("nocacheinfo");
+ 	&mov	("eax",1);
+@@ -120,7 +110,7 @@
+ 	&bt	("edx",28);		# test hyper-threading bit
+ 	&jnc	(&label("generic"));
+ 	&and	("edx",0xefffffff);
+-	&cmp	("edi",0);
++	&cmp	("esi",0);
+ 	&je	(&label("generic"));
+ 
+ 	&or	("edx",0x10000000);
+@@ -132,10 +122,19 @@
+ &set_label("generic");
+ 	&and	("ebp",1<<11);		# isolate AMD XOP flag
+ 	&and	("ecx",0xfffff7ff);	# force 11th bit to 0
+-	&mov	("esi","edx");
++	&mov	("esi","edx");		# %ebp:%esi is copy of %ecx:%edx
+ 	&or	("ebp","ecx");		# merge AMD XOP flag
+ 
+-	&bt	("ecx",27);		# check OSXSAVE bit
++	&cmp    ("edi",7);
++	&mov    ("edi",&wparam(0));
++	&jb     (&label("no_extended_info"));
++	&mov    ("eax",7);
++	&xor    ("ecx","ecx");
++	&cpuid  ();
++	&mov    (&DWP(8,"edi"),"ebx");  # save extended feature flag
++&set_label("no_extended_info");
++
++	&bt     ("ebp",27);             # check OSXSAVE bit
+ 	&jnc	(&label("clear_avx"));
+ 	&xor	("ecx","ecx");
+ 	&data_byte(0x0f,0x01,0xd0);	# xgetbv
+@@ -149,7 +148,6 @@
+ 	&and	("esi",0xfeffffff);	# clear FXSR
+ &set_label("clear_avx");
+ 	&and	("ebp",0xefffe7ff);	# clear AVX, FMA and AMD XOP bits
+-	&mov	("edi",&wparam(0));
+ 	&and	(&DWP(8,"edi"),0xffffffdf);	# clear AVX2
+ &set_label("done");
+ 	&mov	("eax","esi");
diff -Nru openssl-1.0.2g/debian/patches/series openssl-1.0.2g/debian/patches/series
--- openssl-1.0.2g/debian/patches/series	2017-01-30 09:00:43.000000000 -0500
+++ openssl-1.0.2g/debian/patches/series	2017-04-27 20:23:31.000000000 -0400
@@ -46,3 +46,4 @@
 CVE-2016-8610-2.patch
 CVE-2017-3731.patch
 CVE-2017-3732.patch
+move-extended-feature-detection.patch