A critical vulnerability, known as “Zenbleed,” has been discovered by Google’s security researcher Tavis Ormandy, impacting AMD Zen2 CPUs. The flaw, tracked as CVE-2023-20593, has raised concerns as it could allow malicious actors to steal sensitive data, including passwords and encryption keys, from each CPU core at a rate of 30KB/sec. The vulnerability stems from improper handling of the ‘vzeroupper’ instruction during speculative execution, a common performance-enhancing technique used in modern processors.
Ormandy’s discovery of the vulnerability involved using fuzzing and performance counters to identify specific hardware events. He then employed “Oracle Serialization” to validate his findings. This approach allowed the researcher to detect inconsistencies between the execution of a randomly generated program and its serialized oracle, eventually leading to the identification of CVE-2023-20593 in Zen2 CPUs.
The impact of Zenbleed is far-reaching, affecting all AMD CPUs built on the Zen 2 architecture, including the Ryzen 3000 (“Matisse”), Ryzen 4000U/H (“Renoir”), Ryzen 5000U (“Lucienne”), Ryzen 7020, ThreadRipper 3000, and Epyc server (“Rome”) processors. This makes the vulnerability a significant concern for a wide range of systems.
Ormandy responsibly reported the flaw to AMD on May 15, 2023. However, he has since published a proof-of-concept (PoC) exploit for CVE-2023-20593, which currently targets Linux systems. Nonetheless, the vulnerability is considered OS-agnostic, meaning that all operating systems running on Zen 2 CPUs are susceptible to the exploit.
In response to the discovery, AMD has released an updated microcode to address the flaw. Users are strongly advised to apply the update promptly. Alternatively, Ormandy proposes a mitigation method involving setting the “chicken bit” to DE_CFG. However, this workaround comes at the cost of a performance drop, making it less desirable for many users.
While Zenbleed’s practical impact on regular users may be relatively low, as it requires local access to the target system and specialized knowledge to exploit, it remains crucial for users to keep their systems up-to-date with the latest security patches and BIOS updates. Staying vigilant and maintaining security hygiene are essential in safeguarding against potential threats.
In conclusion, the discovery of Zenbleed highlights the ongoing importance of robust security measures and prompt response to vulnerabilities. Manufacturers, researchers, and users alike must collaborate to ensure the safety and integrity of modern computing systems.