Google security researcher Tavis Ormand reported Zenbleed (CVE-2023-20593) to AMD on May 15 before revealing its details this week. As we’ve seen with previous similar attacks like.
Why it matters: A new vulnerability has been discovered that affects the entirety of AMD’s Zen 2 processor line, including the Ryzen 3000/4000/5000 CPUs and the Epyc enterprise processors. Called Zenbleed, the exploit can be used to steal sensitive data such as passwords and encryption keys. Most worrying of all, attacks can be carried out remotely.
Google security researcher Tavis Ormand reported Zenbleed (CVE-2023-20593) to AMD on May 15 before revealing its details this week. As we’ve seen with previous similar attacks like Spectre and Meltdown, it takes advantage of the speculative execution technique used by modern processors to optimize their performance. Zenbleed is closer to the more easily exploitable Meltdown than Spectre.
Zenbleed works by manipulating the register files to force a mispredicted command. As Ormandy explains:
“The bug works like this, first of all you need to trigger something called the XMM Register Merge Optimization2, followed by a register rename and a mispredicted vzeroupper.
