Google’s experienced bug-hunter, Tavis Ormandy, has uncovered a microcode bug in various AMD processors, dubbed “Zenbleed,” which poses a security risk. The bug affects AMD Ryzen and Epic Zen 2 chips, potentially allowing attackers to access usernames and passwords during login processes. Ormandy’s technical writeup revealed that the bug could leak approximately 30kb of data per core per second, enabling attackers to monitor encryption keys and passwords as users log in.
The issue relates to a single CPU instruction, the “VZEROUPPER” instruction, which zeroes the upper 128 bits of the YMM registers. A branch misprediction causes the effects of a speculatively executed VZEROUPPER to be incorrectly rolled back, leading to severe security consequences. An attacker logged into a cloud machine could exploit Zenbleed to spy on other tenants without requiring special privileges.
AMD has been notified of the bug, and the company has issued a microcode patch to address the vulnerability. Citrix has also taken action by releasing a hotfix to mitigate the issue in its systems running on AMD Zen 2 CPUs, although the bug is not related to the Citrix Hypervisor product itself.
Ormandy’s discovery underlines the importance of promptly addressing speculative execution bugs in processors to safeguard user data and protect against potential cyberattacks.