All AMD Zen 2 CPU are affected, Google experts find Zenbleed remote execution vulnerability

Thanks to CTOnews.com netizen OC_Formula for the clue delivery! CTOnews.com July 25, Google Information Security researcher Tavis Ormandy today posted a blog post saying that a new security vulnerability has been discovered in the Zen 2-based AMD processor and named it Zenbleed.

Ormandy said that all Zen 2-based AMD processors were affected and that hackers could exploit the vulnerability to steal protected information such as encryption keys and user login credentials.

Ormandy indicates that hackers do not need physical access to the computer and can be executed through malicious JS scripts on web pages.

Ormandy reported the issue to AMD on May 15, 2023, and AMD has officially released a targeted patch, and Ormandy has not confirmed that the new firmware has fully fixed the vulnerability.

The vulnerability tracking number is CVE-2023-20593 and can steal confidential data at the rate of 30KB per second per core. This attack affects all software running on CPU, including virtual machines, sandboxing, containers, and processes.

CTOnews.com attaches a list of affected Zen 2 processors here:

AMD Ryzen 3000 Series processor

AMD Ryzen PRO 3000 Series processor

AMD Ryzen Threadripper 3000 Series processor

AMD Ryzen 4000 Series processors with Radeon set display

AMD Ryzen PRO 4000 Series processor

AMD Ryzen 5000 Series processors with Radeon set display

AMD Ryzen 7020 Series processors with Radeon set display

AMD EPYC Rome series processors.