CVE-2024-36350

AMD found these while studying a Microsoft report on microarchitectural leaks across isolation boundaries. A load can complete early under some conditions, and the timing of the instructions that depend on it reveals data: here, data from previous stores. AMD’s bulletin lists the EPYC generations it affects and the firmware that fixes each; operating system updates are needed too.

Affected processors

2 of the 4 microarchitectures listed are affected in all or some of their models.

Microarchitecture	Status	Detail	Source
Zen 3	Affected	Milan and Milan-X (EPYC 7003): MilanPI 1.0.0.G and OS updates	amd.com
Zen 4	Some models	Genoa, Genoa-X, Bergamo and Siena (EPYC 9004 and 8004): GenoaPI 1.0.0.E and OS updates; Raphael (EPYC 4004): not affected	amd.com
Zen	Not affected	Naples (EPYC 7001): not affected	amd.com
Zen 2	Not affected	Rome (EPYC 7002): not affected	amd.com

Mitigations

• Firmware: AMD's platform initialization (PI) firmware for each affected EPYC generation, which the operating system part of the fix needs. Source.
• Kernel: Linux executes VERW on return to user space and before entering a guest; the option tsa= limits it to one of the two. Instructions: VERW. Source.

How to check a machine

On Linux, /sys/devices/system/cpu/vulnerabilities/tsa holds one of these lines:

• Not affected
• Vulnerable
• Vulnerable: No microcode
• Mitigation: Clear CPU buffers: user/kernel boundary
• Mitigation: Clear CPU buffers: VM
• Mitigation: Clear CPU buffers

Source.

Related CVEs

• CVE-2024-36348 TSA: control registers
• CVE-2024-36349 TSA: TSC_AUX
• CVE-2024-36357 Transient Scheduler Attack on the L1 cache