CVE-2023-20593

Published: 24 July 2023

An issue in “Zen 2” CPUs, under specific microarchitectural circumstances, may allow an attacker to potentially access sensitive information.

From the Ubuntu Security Team

Tavis Ormandy discovered that some AMD processors did not properly handle speculative execution of certain vector register instructions. A local attacker could use this to expose sensitive information.

Notes

Priority reason:
Allows a local attacker to read the contents of arbitrary processes, even across VM boundaries - PoC is publicly available.

In Ubuntu the linux-firmware source package does not ship the
AMD microcode - instead this is contained within the amd64-microcode
source package. There is also an associated patch for the Linux kernel to
add a new chicken-bit which will automatically be set to enable a fallback
workaround in the kernel in the case that the associated microcode is not
available. Finally, the updates released by AMD on 2023-07-24 only cover
Rome / Castle Peak and Mendocino designs - updates for consumer oriented
designs like Matisse, Renoir etc are expected later in the year.
This is not planned to be fixed for the amd64-microcode package in Ubuntu
14.04 as that release was already outside of the LTS timeframe when this
hardware platform was launched.

Mitigation

Use msr-tools to set a chicken bit on all cores to enable a software workaround
- note this will have some performance cost:
  wrmsr -a 0xc0011029 $(($(rdmsr -c 0xc0011029) | (1<<9)))

Status

Severity score breakdown

References

• https://lore.kernel.org/linux-firmware/20230718231959.3163407-1-john.allen@amd.com/T/#maa00a9e4b26bcdbf0370b24bdb082639ad0b8dd6
• https://marc.info/?l=oss-security&m=169020885715049&w=2
• https://lock.cmpxchg8b.com/zenbleed.html
• https://www.amd.com/en/resources/product-security/bulletin/amd-sb-7008.html
• https://github.com/google/security-research/security/advisories/GHSA-v6wh-rxpg-cmm8
• https://ubuntu.com/security/notices/USN-6244-1
• https://ubuntu.com/security/notices/USN-6315-1
• https://ubuntu.com/security/notices/USN-6316-1
• https://ubuntu.com/security/notices/USN-6317-1
• https://ubuntu.com/security/notices/USN-6318-1
• https://ubuntu.com/security/notices/USN-6321-1
• https://ubuntu.com/security/notices/USN-6324-1
• https://ubuntu.com/security/notices/USN-6325-1
• https://ubuntu.com/security/notices/USN-6328-1
• https://ubuntu.com/security/notices/USN-6329-1
• https://ubuntu.com/security/notices/USN-6330-1
• https://ubuntu.com/security/notices/USN-6331-1
• https://ubuntu.com/security/notices/USN-6332-1
• https://ubuntu.com/security/notices/USN-6342-1
• https://ubuntu.com/security/notices/USN-6346-1
• https://ubuntu.com/security/notices/USN-6348-1
• https://ubuntu.com/security/notices/USN-6342-2
• https://ubuntu.com/security/notices/USN-6357-1
• https://ubuntu.com/security/notices/USN-6385-1
• https://ubuntu.com/security/notices/USN-6397-1
• https://ubuntu.com/security/notices/USN-6532-1
• https://www.cve.org/CVERecord?id=CVE-2023-20593
• NVD
• Launchpad
• Debian