Tavis Ormandy, a researcher with Google Information Security, posted today about a new vulnerability he found in AMD's Zen 2 processors. The ' Zenbleed ' vulnerability spans the entire Zen 2 product stack and allows the theft of protected information from the CPU, including encryption keys and user logins. The attack does not require physical access and can even be executed via javascript on a webpage.
Ormandy says that AMD has issued a firmware fix for affected systems, and although signs of new firmwares did emerge for Linux today , we are unsure if those have the patches. We also have yet to see a security advisory from AMD detailing its response, but we have contacted the company for comment and will update as necessary.
The vulnerability is filed as CVE-2023-20593 and allows data exfiltration (theft) at a rate of 30kb per core, per second, thus providing an adequate amount of throughput to steal any information flowing through the processor. This attack works across all software running on the processor, including virtual machines, sandboxes, containers, and processes.
The attack can be executed with unprivileged arbitrary code execution. Ormandy has posted a security research repository and code for the exploit . The attack works by manipulating the register files to force a mispredicted command, as described below:
"The bug works like this, first of all you need to trigger something called the XMM Register Merge Optimization2, followed by a register rename and a mispredicted vzeroupper. This all has to happen within a precise window to work.
We now know that basic operations like strlen, memcpy and strcmp will use the vector registers - so we can effectively spy on those operations happening anywhere on the system! It doesn’t matter if they’re happening in other virtual machines, sandboxes, containers, processes, whatever!
This works because the register file is shared by everything on the same physical core. In fact, two hyperthreads even share the same physical register file," says Ormandy.
Ormandy says the bug can be patched through a software approach for multiple operating systems (e.g., Windows -"you can set the chicken bit DE_CFG[9]"), but this might result in a performance penalty. Ormandy says it is highly recommended to get the microcode update, but we don't have the details of firmware availability yet.
Ormandy says he reported the issue to AMD on May 15, 2023. Ormandy also credits his colleagues; "I couldn’t have found it without help from my colleagues, in particular Eduardo Vela Nava and Alexandra Sandulescu. I also had help analyzing the bug from Josh Eads."
We've followed up with AMD for more details and will update you as soon as we receive the details.
This is breaking news..more to come.
