AMD processors could be vulnerable to Meltdown-style attacks, according to computer scientists at TU Dresden in Germany.
In a research paper titled "Transient Execution of Non-Canonical Accesses,” the scientists, Saidgani Musaev and Christof Fetzer, looked at AMD Zen+ and Zen 2 processors. The chips tested were the AMD Epyc 7262, Ryzen 7 2700X, and Threadripper 2990WX.
AMD's security bulletin refers to the vulnerability with the name CVE-2020-12965. The flaw works by executing specific software sequences, where AMD CPUs "may transiently execute non-canonical loads and store using only the lower 48 address bits potentially resulting in data leakage."
While attacks like Meltdown relied on fetching data from the L1 data cache and Microarchitectural Data Sampling (MDS) to work, scientists found another way that was “very similar to Meltdown-type behavior.”
“The violation we report does not lead to cross address space leaks, but it provides a reliable way to force an illegal dataflow between microarchitectural elements,” said the scientists.
“The consequence of having a code snippet vulnerable to such behavior may allow an attacker to poison the transient execution of the AMD CPU from the microarchitectural element. In addition, this discovery shows that AMD does implement speculation on memory accesses similar to Meltdown-type attacks, suggesting that even more, similar flaws might be yet to unveil,” the scientists added.
RELATED RESOURCE
The Forrester Wave: Top security analytics platforms
The 11 providers that matter most and how they stack up
The scientists said that while AMD’s design decisions limited the exploitability of such flaws compared to Intel CPUs, it “may be possible to use them to amplify other microarchitectural attacks.”
The scientists alerted AMD about the vulnerability in October 2020. AMD then developed a technique for mitigating the issue.
In an advisory, AMD “recommends that SW vendors analyze their code for any potential vulnerabilities related to this type of transient execution. Potential vulnerabilities can be addressed by inserting an LFENCE or using existing speculation mitigation techniques.”
AMD also outlined in a security whitepaper that there was a variety of techniques software can use to manage processor speculation, each with different properties and trade-offs. AMD said some techniques involve managing what addresses the processor can use for speculative instruction fetch, stopping the dispatch or execution of speculative instructions, or managing what data addresses the processor can calculate
“In addition, newer and future AMD products support additional security features (such as SMEP, SMAP, IBC) which are particularly useful in controlling speculation across kernel/ user privilege boundaries,” the company said.
-
Cleo attack victim list grows as Hertz confirms customer data stolenNews Hertz has confirmed it suffered a data breach as a result of the Cleo zero-day vulnerability in late 2024, with the car rental giant warning that customer data was stolen.
-
Lateral moves in tech: Why leaders should support employee mobilityIn-depth Encouraging staff to switch roles can have long-term benefits for skills in the tech sector
-
Hackers are targeting Ivanti VPN users again – here’s what you need to knowNews Ivanti has re-patched a security flaw in its Connect Secure VPN appliances that's been exploited by a China-linked espionage group since at least the middle of March.
-
Broadcom issues urgent alert over three VMware zero-daysNews The firm says it has information to suggest all three are being exploited in the wild
-
Nakivo backup flaw still present on some systems months after firms’ ‘silent patch’, researchers claimNews Over 200 vulnerable Nakivo backup instances have been identified months after the firm silently patched a security flaw.
-
Everything you need to know about the Microsoft Power Pages vulnerabilityNews A severe Microsoft Power Pages vulnerability has been fixed after cyber criminals were found to have been exploiting unpatched systems in the wild.
-
Vulnerability management complexity is leaving enterprises at serious riskNews Fragmented data and siloed processes mean remediation is taking too long
-
A critical Ivanti flaw is being exploited in the wild – here’s what you need to knowNews Cyber criminals are actively exploiting a critical RCE flaw affecting Ivanti Connect Secure appliances
-
Researchers claim an AMD security flaw could let hackers access encrypted dataNews Using only a $10 test rig, researchers were able to pull off the badRAM attack
-
GPU memory vulnerability could allow hackers to access LLM responses - and Apple, Qualcomm, and AMD products were all at riskNews The GPU memory vulnerability could've left large language models wide open to exploitation by threat actors
