Key Takeaways
- Zenbleed, a new exploit affecting AMD Ryzen CPUs, has been disclosed.
- The vulnerability allows remote execution through a website’s JavaScript and can transfer data from the CPU. It doesn’t require special privileges or system calls, making it a significant security concern.
- Although AMD has released a patch for server CPUs, a fix for consumer CPUs may take a few months.
Security problems with processors are nothing new: the worst example might still be the Meltdown and Spectre exploits from a few years ago. A new backdoor has been discovered in AMD’s Ryzen processors, and it’s pretty bad.
A new exploit has been disclosed that affects many people using AMD Ryzen CPUs. Codenamed “Zenbleed,” the vulnerability affects all Ryzen chips using the Zen 2 architecture. This means that chips belonging to the Ryzen 3000 and Ryzen 4000 series are affected, and so are a number of chips belonging to the Ryzen 5000 and Ryzen 7020 (mostly laptops in these last two).
It’s an architecture that remains widely used despite AMD having released two successors, Zen 3 and Zen 4 — the first Ryzen 3000 chips were released in 2019 to critical acclaim, and are credited by many as being a turning point for AMD in its competition against Intel. So as you might be able to notice, it’s used a lot. Zen 2 chips are also used in gaming devices owned by millions of people — namely, the PlayStation 5, Xbox Series X, and Xbox Series S. Also, all Steam Deck handhelds all use Zen 2 CPUs.
For an attacker to take advantage of a system, they don’t need physical access to the system itself — it can be executed remotely through a Javascript on a website. The vulnerability also doesn’t require any type of special system calls, privileges, or anything of the like. And if the exploit is successfully executed, it can transfer data out of your CPU at a rate of 30 kb per second, per core. It’s pretty scary stuff, if you ask us.
AMD has released a microcode patch for AMD’s EPYC 7002 range of server CPUs, but consumer CPUs don’t really have a fix yet — and it could be a few months before we see one. Make sure to update your BIOS whenever you see an update fixing this issue. And until that point, try your best to stay safe out there and avoid shady websites. Or use a software workaround that should fix it at the cost of a performance penalty.
Source: Tavis Ormandy
Via: The Verge
