It is no longer exclusive to Intel CPUs. TheRegister reports that AMD's Zen processor family is vulnerable to a data-bothering Meltdown-like attack.
However, exploiting this weakness is more likely an academic interest. For an attacker, there are more easy ways to breach the target device. Anyway, the situation clearly shows that modern CPUs have extremely complicated architectures that may cause unexpected behaviors.
Advertisеment
The vulnerability has been discovered by researchers at TU Dresden in Germany, Saidgani Musaev and Christof Fetzer. They tested AMD Zen+ and Zen 2 chips, Epyc 7262, Ryzen 7 2700X, and Threadripper 2990WX, and found out that there is a way to adversely manage the operation of the CPU cores.
That effect is similar to Meltdown and Spectre flaws, which allow accessing the contents of protected kernel memory, such as keys. Initially, AMD claimed that their products are not affect by this kind of attacks, but this seem to have changed. While the method of poisoning the data cache for AMD CPUs is different, the result is very similar to the Meltdown attack.
The violation we report does not lead to cross address space leaks, but it provides a reliable way to force an illegal dataflow between microarchitectural elements. Unlike the previous AMD vulnerabilities, the flaw we report is the first flaw that proves that it is possible to force an illegal data flow between microarchitectural elements.
More details of the research can be found in this paper.
AMD issued a security advisory for this issue earlier this month, CVE-2020-12965. It notes the following: "When combined with specific software sequences, AMD CPUs may transiently execute non-canonical loads and store using only the lower 48 address bits potentially resulting in data leakage."
AMD recommends to mitigate this issue on the software level. Dev are advised to check their code for transient execution vulnerabilities and insert an LFENCE instruction. It causes a performance hit. It is worth noting that certain software is immutable to this kind of attacks, including Firefox's JS engine and Linux kernel.
Finally, the researches noted that Intel CPUs may also be vulnerable to the discovered flaw, thought the most recent units already come with a protection against it.
Support us
Winaero greatly relies on your support. You can help the site keep bringing you interesting and useful content and software by using these options:
If you like this article, please share it using the buttons below. It won't take a lot from you, but it will help us grow. Thanks for your support!
Advertisеment
