Processor vulnerability
CVE-2023-20593
Under specific conditions a YMM register on Zen 2 is not written to zero correctly and can hold data from another process or thread.
- Name
- Cross-Process Information Leak
- Also known as
- Zenbleed
- Kind
- Transient execution
- CVE published
- 2023-07-24 CVE record
- Advisories
- AMD-SB-7008
Under specific microarchitectural circumstances a register on Zen 2
processors is not set to zero as it should be. The YMM register then
holds data that belonged to another process or thread on the core,
which the attacker reads. AMD issued microcode for EPYC 7002 and
AGESA firmware for the other Zen 2 products. Linux 7.3 sets a
chicken bit in DE_CFG on Zen 2 processors with AVX whose microcode
is older than the fixed revisions it lists, and clears it otherwise;
Tavis Ormandy of Google reported it.What the sources say of each microarchitecture.
Affected processors
1 of the 1 microarchitectures listed are affected in all or some of their models.