Researchers have discovered a vulnerability in AMD Zen2 processors that exposes the contents of registers in other processes

Short description

Summarize this content to 100 words Google security researcher Tavis Ormandy discovered the CVE-2023-20593 vulnerability in AMD Zen2 processors. It can be used to monitor the contents of registers while other processes are running on the same CPU core. In the exploit, Ormandy shows how an unprivileged user can expose data processed in AES-NI or REP-MOVS instructions. This information can be used to recover encryption keys and privileged user passwords that are processed by other processes. Data leakage performance reaches 30KB per second. The attack can be carried out from virtual machines and isolated environments.The exploit is written for Linux, but the bug is OS-independent, so all operating systems running on Zen 2. ), Ryzen 7020 and high-performance ThreadRipper 3000 processors, as well as Epyc server (“Rome”) processors were affected.Users are advised to apply the AMD update or wait for the computer vendor to include the fix in a future BIOS update.Alternatively, the control bit can be set to DE_CFG[9]although this will result in a drop in CPU performance.According to Ormandy, the practical impact of the vulnerability on ordinary users is relatively small, since exploiting it requires local access to the target system and additional knowledge.

Researchers have discovered a vulnerability in AMD Zen2 processors that exposes the contents of registers in other processes

Google security researcher Tavis Ormandy discovered the CVE-2023-20593 vulnerability in AMD Zen2 processors. It can be used to monitor the contents of registers while other processes are running on the same CPU core.

In the exploit, Ormandy shows how an unprivileged user can expose data processed in AES-NI or REP-MOVS instructions. This information can be used to recover encryption keys and privileged user passwords that are processed by other processes. Data leakage performance reaches 30KB per second. The attack can be carried out from virtual machines and isolated environments.

The exploit is written for Linux, but the bug is OS-independent, so all operating systems running on Zen 2. ), Ryzen 7020 and high-performance ThreadRipper 3000 processors, as well as Epyc server (“Rome”) processors were affected.

Users are advised to apply the AMD update or wait for the computer vendor to include the fix in a future BIOS update.

Alternatively, the control bit can be set to DE_CFG[9]although this will result in a drop in CPU performance.

According to Ormandy, the practical impact of the vulnerability on ordinary users is relatively small, since exploiting it requires local access to the target system and additional knowledge.

Related posts