Zenbleed: New Flaw in AMD Zen 2 Processors Puts Encryption Keys and Passwords at Risk
25.7.23  Vulnerebility  The Hacker News

A new security vulnerability has been discovered in AMD's Zen 2 architecture-based processors that could be exploited to extract sensitive data such as encryption keys and passwords.

Discovered by Google Project Zero researcher Tavis Ormandy, the flaw – codenamed Zenbleed and tracked as CVE-2023-20593 (CVSS score: 6.5) – allows data exfiltration at the rate of 30 kb per core, per second.

The issue is part of a broader category of weaknesses called speculative execution attacks, in which the optimization technique widely used in modern CPUs is abused to access cryptographic keys from CPU registers.

"Under specific microarchitectural circumstances, a register in 'Zen 2' CPUs may not be written to 0 correctly," AMD explained in an advisory. "This may cause data from another process and/or thread to be stored in the YMM register, which may allow an attacker to potentially access sensitive information."

Web infrastructure company Cloudflare noted that the attack could even be carried out remotely through JavaScript on a website, thereby obviating the need for physical access to the computer or server.
"Vectorized operations can be executed with great efficiency using the YMM registers," Cloudflare researchers Derek Chamorro and Ignat Korchagin said. "Applications that process large amounts of data stand to gain significantly from them, but they are increasingly the focus of malicious activity."

"This attack works by manipulating register files to force a mispredicted command. Since the register file is shared by all the processes running on the same physical core, this exploit can be used to eavesdrop on even the most fundamental system operations by monitoring the data being transferred between the CPU and the rest of the computer," they added.

While there is no evidence of the bug being exploited in the wild, it's essential that the microcode updates are applied to mitigate potential risk as and when they become available through original equipment manufacturers (OEMs).