Zenbleed: registers leaking between processes

Leak rate per core reported by the researcher

~30 kb/sTavis Ormandy, lock.cmpxchg8b.com

How it worked

Vector registers are shared physical resources that the CPU maps to programs. A speculatively executed instruction freed a register mapping that later had to be restored — but by then another process could have written to it. Reading the register returned that other process's data, including strings handled by common functions like strlen and memcpy.

Our reading

Analysis — Altumptic's interpretation of the sources below.

• CPUs can be fuzzed like software, and they have software-like bugs.
• Cloud co-tenancy multiplies the impact of every leak at this level.
• Microcode is part of your patch inventory.

What it means for you

1. Apply AMD microcode and firmware updates; check that your kernel loads them.
2. Where microcode is not yet available, apply the documented chicken-bit workaround.
3. Treat CPU advisories with the same urgency as kernel ones on multi-tenant hosts.