English
Magyar
On 24 July 2023, AMD issued a security advisory revealing a vulnerability in the Zen 2 computer processor microarchitecture. The vulnerability, referred to by AMD as a “Cross-Process Information Leak”, is also known as “Zenbleed”. The issue, labelled CVE-2023-20593 and classified by AMD as moderate, allows an attacker to access sensitive information processed by the CPU under certain circumstances. The issue affects all software running on AMD Zen 2-based processors, including virtual machines, sandboxes, containers and processes. Exploit code is likely to be available, and attacks exploiting this vulnerability are expected to occur soon.
All AMD Zen 2 CPUs, including EPYC Rome processors, are vulnerable:
- AMD Ryzen 3000 series processors
- AMD Ryzen PRO 3000 series processors
- AMD Ryzen Threadripper 3000 series processors
- AMD Ryzen 4000 series processors with Radeon graphics
- AMD Ryzen PRO 4000 series processors
- AMD Ryzen 5000 series processors with Radeon graphics
- AMD Ryzen 7020 series processors with Radeon graphics
- 2nd-generation AMD EPYC “Rome” processors
Eliminating vulnerabilities
Loading patched microcode at start-up by updating the firmware package
This solution triggers an update to the processor’s microcode when the operating system is updated (for example, using the linux-firmware package). You can do this as soon as the operating system maintainer or the community releases the updated package. This method depends on the distribution or the operating system developer, and only works if the appropriate microcode has been provided by AMD. To date, this method is only applicable to ‘Zen2 Rome’ and ‘Zen2 Castle Peak’.
Protection with an updated kernel
If a microcode update is not available via a firmware update package, the kernel can be updated to a version that disables the faulty processor function by configuring a so-called ‘chicken bit’. This may affect system performance. Operating system developers will incorporate this solution when backporting a new version of the Linux kernel. We recommend that our customers prioritise this mitigation strategy, as it is the most effective, since it does not depend on the hardware manufacturer providing updated microcode.
Alternatively, you can configure the ‘chicken bit’ manually without relying on a kernel update. However, we do not recommend this solution, as it may pose a risk to your system.