cyber.hendryadrian.com
Vulnerability & Exploit · wiz.io

Zenbleed Flaw Could Leak Data Across Processes on AMD Zen 2 CPUs

· Original article ↗

Summary

CVE-2023-20593 is a Zen 2 processor flaw that can let local unprivileged code read privileged-process data. The article lists affected CPUs and cloud instances, discusses provider patch status, and recommends host-level microcode updates.

Key points

  • The use-after-free flaw involves handling of the vzeroupper instruction during speculative execution and affects AMD Zen 2 processors.
  • An attacker needs existing local code execution; the flaw can allow an unprivileged process to read privileged-process memory, including across some isolated environments.
  • Affected products include Ryzen 3000, 4000U/H, 5000U, 7020, Threadripper 3000, and Epyc Rome CPUs; the article says the issue is not OS-dependent.
  • The article identifies AWS C5a, C5ad, G4ad, and G5 instances; Azure HBv2, Da_v3, and Ea_v3 VMs; and specified GCP n2d instances as potentially affected.
  • At publication, the article reported GCP had patched hosts and AWS had later updated its advisory to say all hosts were patched; it said Azure and other providers had not yet issued bulletins.
  • The recommended fix is an AMD microcode update applied on the host, or a vendor BIOS update. Customers cannot apply the microcode fix from inside a cloud VM.
  • The article recommends identifying affected instances and securing them until providers confirm patching; it also describes checking CPU model and microcode status on Linux VMs.

Article Details

Vulnerability Types
  • Use-after-free flaw involving improper handling of the vzeroupper instruction during speculative execution
Severity
Low severity in cloud environments, according to Wiz.
Affected Versions
  • AMD Zen 2 processors
Exploitation Status
unknown
Exploit Availability
unknown
Patch Status
partial
Workarounds
  • Apply AMD's new microcode update, or wait for the computer vendor to incorporate the fix in a future BIOS upgrade.

MITRE ATT&CK

T1003 · OS Credential DumpingThe flaw can allow an unprivileged local process to read memory from a privileged process.T1068 · Exploitation for Privilege EscalationThe article describes potential privilege escalation by an attacker with unprivileged access to an affected machine.

CVE

CVE-2023-20593What is CVE-2023-20593? 

People

Tavis OrmandyResearcher associated with the vulnerability disclosure; the article links to his blog.

Vendors

AMDResearchers discovered a use-after-free flaw in AMD Zen 2 processors, which could allow a malicious actor to steal sensitive data, such as passwords and encryption keys. While many cloud environments have workloadsWizWiz customers can use the pre-built query and advisory in the Wiz Threat Center to search for vulnerable instances in their environment. 

Products

AWSall) potentially affected VM instances are running on “Rome”, which is a CPU designed for datacenters. In AWS, this includes C5a, C5ad, G4ad, and G5 EC2 instance types. In Azure, this includes HBv2, Da_v3 and Ea_v3Azureis a CPU designed for datacenters. In AWS, this includes C5a, C5ad, G4ad, and G5 EC2 instance types. In Azure, this includes HBv2, Da_v3 and Ea_v3 VMs. In GCP, this includes n2d-s2 (Rome), n2d-s4 (Rome) and n2d-s8EpycEpyc server ("Rome") GCPincludes C5a, C5ad, G4ad, and G5 EC2 instance types. In Azure, this includes HBv2, Da_v3 and Ea_v3 VMs. In GCP, this includes n2d-s2 (Rome), n2d-s4 (Rome) and n2d-s8 (Rome) VMs. Ryzen 3000Ryzen 3000 ("Matisse") Ryzen 4000U/HRyzen 4000U/H ("Renoir")  Ryzen 5000URyzen 5000U ("Lucienne") Wiz Threat CenterWiz customers can use the pre-built query and advisory in the Wiz Threat Center to search for vulnerable instances in their environment. Zen 2Researchers discovered a use-after-free flaw in AMD Zen 2 processors, which could allow a malicious actor to steal sensitive data, such as passwords and encryption keys. While many cloud environments have workloads

Related Articles