Processor vulnerability
CVE-2022-23823
AMD's CVE for Hertzbleed: frequency scaling on Zen to Zen 3 processors turns data-dependent power into timing that an attacker can measure.
- Name
- Frequency Scaling Timing Power Side-Channels
- Also known as
- Hertzbleed
- Vulnerability
- Frequency Throttling Side Channel
- Kind
- Side channel
- CVE published
- 2022-06-15 CVE record
- Advisories
- AMD-SB-1038
AMD’s bulletin follows the Hertzbleed paper: with frequency scaling,
the time a computation takes can depend on its data through the
power it draws. AMD lists Zen to Zen 3 processors and the last
Bulldozer-family APUs, and leaves the fix to the cryptographic code.What the sources say of each microarchitecture.
Affected processors
5 of the 5 microarchitectures listed are affected in all or some of their models.
| Microarchitecture | Status | Detail | Source |
|---|---|---|---|
| Excavator | Some models | 7th Gen A-Series APUs and Athlon X4 | amd.com |
| Zen | Some models | 1st Gen EPYC (7001); Ryzen 2000 and Athlon 3000 mobile | amd.com |
| Zen+ | Some models | Ryzen 2000 desktop; 2nd Gen Threadripper (2000) | amd.com |
| Zen 2 | Some models | 2nd Gen EPYC (7002); Ryzen 3000 desktop and 4000; 3rd Gen Threadripper (3000) | amd.com |
| Zen 3 | Some models | 3rd Gen EPYC (7003); Ryzen 5000 | amd.com |
Mitigations
- Programs: Countermeasures in the algorithm's code against power analysis: masking, hiding or key rotation. Source.
- Programs: Not exposing interfaces that set power limits, such as MSR_PKG_POWER_LIMIT, to untrusted software, so it cannot lower them. Instructions: WRMSR. Source.
Related CVEs
- CVE-2022-24436 Frequency Throttling Side Channel