Tuesday, July 25th 2023
Zenbleed Vulnerability Affects All AMD Zen 2 CPUs
A new vulnerability has been discovered in AMD Zen 2 based CPUs by Tavis Ormandy, a Google Information Security researcher. Ormandy has named the new vulnerability Zenbleed—also known as CVE-2023-20593—and it's said to affect all Zen 2 based AMD processors, which means Ryzen 3000, 4000 and 5000-series CPUs and APUs, as well as EPYC server chips. The reason why Zenbleed is of concern is because it doesn't require a potential attacker to have physical access to the computer or server in question and it's said to be possible to trigger the vulnerability via executing a javascript on a webpage. This means that the attack vector ends up being massive, at least when we're talking about something like a webhosting company.
Zenbleed is said to allow a potential attacker to gain access to things like encryption keys and user logins via triggering something called "the XMM Register Merge Optimization2, followed by a register rename and a mispredicted vzeroupper." Apparently this requires some precision for the vulnerability to work, but due to these registers being used system wide, even a sandboxed attacker can gain access to them. AMD has already issued a patch for its EPYC server CPUs, which obviously are the most vulnerable systems in question and the company is planning to release patches for all of its Zen 2 based CPUs before the end of the year. Hit up the source links for more details about Zenbleed.
Sources:
Tom's Hardware, Zenbleed by Tavis Ormandy, AMD Security Bulletin
Zenbleed is said to allow a potential attacker to gain access to things like encryption keys and user logins via triggering something called "the XMM Register Merge Optimization2, followed by a register rename and a mispredicted vzeroupper." Apparently this requires some precision for the vulnerability to work, but due to these registers being used system wide, even a sandboxed attacker can gain access to them. AMD has already issued a patch for its EPYC server CPUs, which obviously are the most vulnerable systems in question and the company is planning to release patches for all of its Zen 2 based CPUs before the end of the year. Hit up the source links for more details about Zenbleed.
19 Comments on Zenbleed Vulnerability Affects All AMD Zen 2 CPUs
Only the APU's of the the 5000 series are involved according the researcher.
Spectre / meltdown anyone?...
At least the patches for this shouldn't have any real world performance reduction for most consumers, if it even needs to be patched for a consumer PC. Not sure if it'll effect things on servers or not.
I'm not saying it's impossible, but you'd really need to know alot to be able to access some random persons PC to steal their credentials for something.
As far as I know 5600G and 5700G shouldnt be affected as Zen 3 core's.
When I was making my 21H2 install ISO, on my post install script I added an option for configuration available CPU mitigations.
The amount now is staggering, half of the configurable one's are disabled by default. I will attach the configurations in a code box. When I tried out Confusion mitigation, wow it was literally about a 1/3 of the speed. So yeah I think now days these stories are less of a reaction as people have just got used to it and if it has any noticeable performance impact it tends to get disabled either by user or the vendor.
List of AMD Ryzen processors - Wikipedia