Rewterz Threat Update – AMD Zen2 Processors Vulnerable to Zenbleed Attack, Exposing Sensitive Data Leakage

Severity

High

Analysis Summary

A critical vulnerability, known as “Zenbleed,” has been discovered by Google’s security researcher Tavis Ormandy, impacting AMD Zen2 CPUs. The flaw, tracked as CVE-2023-20593, has raised concerns as it could allow malicious actors to steal sensitive data, including passwords and encryption keys, from each CPU core at a rate of 30KB/sec. The vulnerability stems from improper handling of the ‘vzeroupper’ instruction during speculative execution, a common performance-enhancing technique used in modern processors.

Ormandy’s discovery of the vulnerability involved using fuzzing and performance counters to identify specific hardware events. He then employed “Oracle Serialization” to validate his findings. This approach allowed the researcher to detect inconsistencies between the execution of a randomly generated program and its serialized oracle, eventually leading to the identification of CVE-2023-20593 in Zen2 CPUs.

The impact of Zenbleed is far-reaching, affecting all AMD CPUs built on the Zen 2 architecture, including the Ryzen 3000 (“Matisse”), Ryzen 4000U/H (“Renoir”), Ryzen 5000U (“Lucienne”), Ryzen 7020, ThreadRipper 3000, and Epyc server (“Rome”) processors. This makes the vulnerability a significant concern for a wide range of systems.

Ormandy responsibly reported the flaw to AMD on May 15, 2023. However, he has since published a proof-of-concept (PoC) exploit for CVE-2023-20593, which currently targets Linux systems. Nonetheless, the vulnerability is considered OS-agnostic, meaning that all operating systems running on Zen 2 CPUs are susceptible to the exploit.

In response to the discovery, AMD has released an updated microcode to address the flaw. Users are strongly advised to apply the update promptly. Alternatively, Ormandy proposes a mitigation method involving setting the “chicken bit” to DE_CFG[9]. However, this workaround comes at the cost of a performance drop, making it less desirable for many users.

While Zenbleed’s practical impact on regular users may be relatively low, as it requires local access to the target system and specialized knowledge to exploit, it remains crucial for users to keep their systems up-to-date with the latest security patches and BIOS updates. Staying vigilant and maintaining security hygiene are essential in safeguarding against potential threats.

In conclusion, the discovery of Zenbleed highlights the ongoing importance of robust security measures and prompt response to vulnerabilities. Manufacturers, researchers, and users alike must collaborate to ensure the safety and integrity of modern computing systems.

Impact

• Information Disclosure

Indicators of Compromise

CVE

CVE-2023-20593

Affected Product

• Amd

Affected Vendor

• AMD 2nd Generation EPYC
• AMD Ryzen 3000 series Desktop processors
• AMD Ryzen 4000 Series Desktop processors with Radeon graphics
• AMD Ryzen 5000 Series Mobile Processors with Radeon Graphics
• AMD Ryzen 4000 Series Mobile Processors with Radeon Graphics
• AMD Ryzen 7020 Series Processors
• AMD Ryzen Threadripper PRO 3000WX Series Processors

Remediation

• Refer to AMD Security Bulletin for patch, upgrade or suggested workaround information.
• Wait for computer vendors to release BIOS updates incorporating the fix to address the Zenbleed vulnerability.
• Implement a robust patch management process to ensure that all systems, including CPUs, receive timely security updates.
• Limit users’ access to sensitive data and critical functions to minimize the risk of unauthorized data leakage.
• Employ network segmentation to segregate critical systems from less sensitive ones, reducing the potential impact of an attack.
• Provide security awareness training to employees, educating them about potential threats and safe computing practices.
• Utilize virtualization security features to enhance the isolation of virtual machines and containers from the host system.
• Develop a comprehensive incident response plan to respond effectively in case of a security breach or data leakage.