oss-sec mailing list archives
Re: CVE-2023-20593: A use-after-free in AMD Zen2 Processors
From: "alice" <alice () ayaya dev>
Date: Tue, 25 Jul 2023 18:55:11 +0000
On Tue Jul 25, 2023 at 6:30 PM UTC, Jeffrey Walton wrote:
On Tue, Jul 25, 2023 at 2:14 PM Demi Marie Obenour <demi () invisiblethingslab com> wrote:On Tue, Jul 25, 2023 at 06:12:44PM +0100, Eddie Chapman wrote:alice wrote:this is a disaster of a security announcement from AMD. nothing is fixed except for epyc. the only workaround anyone really has is the chicken bit, thankfully.Yes, very disappointing. Pure speculation; perhaps they were planning on disclosing at the end of the year with full set of Microcode ready but something we don't know (yet) forced them to disclose early. Who knows.Does AMD make OS-loadable μcode patches available for client platforms, or must all μcode loading on clients be done by the firmware? If the latter, then it will take a very long time for clients to get patched, even if AMD released the updates promptly. Also, server platforms can usually reflash the firmware via the BMC, but client platforms do not have this option.Related, Ubuntu released an updated amd64-microcode around (or before) 1:45 PM EST today. My Ubuntu machines have already been patched. I was kind of surprised to see how quickly it landed.
the updated amd64-microcode only contains the fixes published to linux-firmware, which only affects epyc cpus, as noted. unless you're running epyc cpus (which is slightly unlikely so i thought i'd mention it, but apologies if that is indeed the case) you didn't actually receive any fix. the latest kernel released today sets the chicken bit if no patched ucode is loaded which also works to mitigate the issue. (https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=522b1d69219d8f083173819fde04f994aa051a98) you can test this by running the zenbleed reproduction, from https://cmpxchg8b.com/files/zenbleed-v5.tar.gz (if it outputs anything, you're vulnerable)
Jeff
Current thread:
- CVE-2023-20593: A use-after-free in AMD Zen2 Processors Tavis Ormandy (Jul 24)
- Re: CVE-2023-20593: A use-after-free in AMD Zen2 Processors Marc Deslauriers (Jul 24)
- Re: CVE-2023-20593: A use-after-free in AMD Zen2 Processors Jonathan Gray (Jul 25)
- Re: CVE-2023-20593: A use-after-free in AMD Zen2 Processors alice (Jul 25)
- Re: CVE-2023-20593: A use-after-free in AMD Zen2 Processors Eddie Chapman (Jul 25)
- Re: CVE-2023-20593: A use-after-free in AMD Zen2 Processors Matthias Schmidt (Jul 25)
- Re: CVE-2023-20593: A use-after-free in AMD Zen2 Processors Demi Marie Obenour (Jul 25)
- Re: CVE-2023-20593: A use-after-free in AMD Zen2 Processors Lucas Rolff (Jul 25)
- Re: CVE-2023-20593: A use-after-free in AMD Zen2 Processors Jeffrey Walton (Jul 25)
- Re: CVE-2023-20593: A use-after-free in AMD Zen2 Processors alice (Jul 25)
- Re: CVE-2023-20593: A use-after-free in AMD Zen2 Processors Jonathan Gray (Jul 25)
- Re: CVE-2023-20593: A use-after-free in AMD Zen2 Processors Marc Deslauriers (Jul 24)