Sunday, August 29th 2021

Meltdown-like Vulnerability Affects AMD Zen+ and Zen2 Processors

Cybersecurity researchers Saidgani Musaev and Christof Fetzer with the Dresden Technology University discovered a novel method of forcing illegal data-flow between microarchitectural elements on AMD processors based on the "Zen+" and "Zen 2" microarchitectures, titled "Transient Execution of Non-canonical Accesses." The method was discovered in October 2020, but the researchers followed responsible-disclosure norms, giving AMD time to address the vulnerability and develop a mitigation. The vulnerability is chronicled under CVE-2020-12965 and AMD Security Bulletin ID "AMD-SB-1010."

The one-line summary of this vulnerability from AMD reads: "When combined with specific software sequences, AMD CPUs may transiently execute non-canonical loads and store using only the lower 48 address bits, potentially resulting in data leakage." The researchers studied this vulnerability on three processors, namely the EPYC 7262 based on "Zen 2," and Ryzen 7 2700X and Ryzen Threadripper 2990WX, based on "Zen+." They mention that all Intel processors that are vulnerable to MDS attacks "inherently have the same flaw." AMD is the subject of the paper as AMD "Zen+" (and later) processors are immune to MDS as demonstrated on Intel processors. AMD developed a mitigation for the vulnerability, which includes ways of patching vulnerable software.

Find the security research paper here (PDF), and the AMD security bulletin here. AMD's mitigation blueprint can be accessed here.
Add your own comment

41 Comments on Meltdown-like Vulnerability Affects AMD Zen+ and Zen2 Processors

#26
medi01
lexluthermiesterincluding attacker physical presence
I'm puzzled why did you conclude that, could you elaborate?
Posted on Reply
#27
lexluthermiester
medi01I'm puzzled why did you conclude that, could you elaborate?
Have you read the pdf? Please do if you haven't and if you don't find it, I'll do my best to help you out.
Posted on Reply
#28
medi01
lexluthermiesterHave you read the pdf? Please do if you haven't and if you don't find it, I'll do my best to help you out.
Could you share the link to the specific PDF you mean please? The one in your post is an html page with 2 PDFs.
Posted on Reply
#29
lexluthermiester
medi01Could you share the link to the specific PDF you mean please? The one in your post is an html page with 2 PDFs.
It's in the article post.
btarunrFind the security research paper here (PDF), and the AMD security bulletin here. AMD's mitigation blueprint can be accessed here.
Posted on Reply
#30
R-T-B
lexluthermiesterThe mitigation for this vulnerability is just a minor, easily made, change to existing mitigations.
That's easy to say but when you have a old software application that's not being updated it just means you are screwed.

I'm pretty sure the decades old court reporter record reading software we run won't see such an update.
Posted on Reply
#31
lexluthermiester
R-T-BThat's easy to say but when you have a old software application that's not being updated it just means you are screwed.
You're failing to understand how this vulnerability works. Old software, of any kind, is not an entry vector of attack. Like Meltdown, a software package has to be delivered to the target system and run by a user physically attending the system.
R-T-BI'm pretty sure the decades old court reporter record reading software we run won't see such an update.
See above.
Posted on Reply
#32
R-T-B
lexluthermiesterYou're failing to understand how this vulnerability works. Old software, of any kind, is not an entry vector of attack.
Oh, so the old software already includes an LFFENCE to prevent it being used for priviledge escalation?

I'm starting to think you don't really understand this. I mean that with no offense intended. It's tough material.
Posted on Reply
#33
lexluthermiester
R-T-BOh, so the old software already includes an LFFENCE to prevent it being used for priviledge escalation?
And how would an attacker do that? Hmm? Are they going to wave an Elder wand?
R-T-BI'm starting to think you don't really understand this.
Likewise, and as AMD has already made a statement on the matter after months of research....
R-T-BIt's tough material.
Seemingly so..
Posted on Reply
#34
R-T-B
lexluthermiesterAnd how would an attacker do that? Hmm? Are they going to wave an Elder wand?
A dumb end user. You can't trust them all but you can fence them off. At least, you can on certain cpus.
Posted on Reply
#35
lexluthermiester
R-T-BA dumb end user. You can't trust them all but you can fence them off. At least, you can on certain cpus.
So what you are saying is that...
lexluthermiestera user physically attending the system.
...is required. At that point older software is not relevant as you still need to deliver a software payload to initiate the attack.

So how am I failing to understand?
Posted on Reply
#36
R-T-B
You can't priviledge escalate a bug that does not exist. Even if the user downloads something via social engineering. That's why a microcode approach is more reliable.
Posted on Reply
#37
lexluthermiester
R-T-BYou can't priviledge escalate a bug that does not exist. Even if the user downloads something via social engineering. That's why a microcode approach is more reliable.
Ah, I see now...
Posted on Reply
#38
R-T-B
lexluthermiesterAh, I see now...
Yeah. It's not a big hole but it's there. Requires a lot of human failure
Posted on Reply
#39
lexluthermiester
lexluthermiesterAh, I see now...
R-T-BYeah. It's not a big hole but it's there. Requires a lot of human failure
My sarcasm might have been a bit too subtle there..

While this vulnerability is real, exploiting it(much like Spectre, Meltdown and all of that ilk) is so crazy difficult that it isn't worth worrying about unless you have something worth stealing and people know you have something worth stealing. So AMD's response is appropriate, as is mine. It's very, very nearly nothing-sauce.
Posted on Reply
#40
R-T-B
lexluthermiesterIt's very, very nearly nothing-sauce.
and I'll profesionally disagree with you.

It's nothing-sauce for the average home user, but not everyone of AMDs clients is the average home user.

I for one am glad there are no Zen/Zen 2 cpus in my org, as I'd have to treat them special, and thats just extra headache for me.

I know you have your opinions on this. I am curious if they'd be the same if you had to sign the same contracts I do, but that's really beyond where we should go for this topic. I respect your right to disagree, regardless.
Posted on Reply
#41
lexluthermiester
R-T-BIt's nothing-sauce for the average home user, but not everyone of AMDs clients is the average home user.
Fully agree with you there.
R-T-BI for one am glad there are no Zen/Zen 2 cpus in my org, as I'd have to treat them special, and thats just extra headache for me.
That only requires a risk assessment analysis. However, that difficulty can not be understated for some organizations.
R-T-BI know you have your opinions on this. I am curious if they'd be the same if you had to sign the same contracts I do, but that's really beyond where we should go for this topic. I respect your right to disagree, regardless.
For business/industrial/corp/gov entities there needs to be serious consideration on a case by case basis. But once again, not all situations warrant concern for potential attack. I am governed by regulations and those guidelines require due diligence. While risk assessment will be done, my earlier statements are based on previous similar vulnerabilities analysis.
Posted on Reply
Add your own comment
Nov 23rd, 2024 07:13 EST change timezone

New Forum Posts

Popular Reviews

Controversial News Posts