{"uuid": "9de26c3f-f671-4fe6-9e08-09045668cdc9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-20593", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/111464", "content": "Black Hat Ethical Hacking\nZenbleed: Critical Flaw Found in AMD Zen2 CPUs That Could Leak Sensitive Data\n\nZenbleed: Critical Flaw Found in AMD Zen2 CPUs That Could Leak Sensitive DataPost Views: 29 Premium Contenthttps://www.blackhatethicalhacking.com/wp-content/uploads/2023/07/Patreon.png Subscribe to Patreon to watch this episode.\nReading Time: 3 Minutes\nGoogle\u2019s renowned security researcher Tavis Ormandy has uncovered a significant vulnerability called Zenbleed\u00a0affecting AMD Zen2 CPUs, posing a serious risk of data theft. The flaw, tracked as CVE-2023-20593, allows malicious actors to pilfer sensitive information, including passwords and encryption keys, at an alarming rate of 30KB/sec from each CPU core.\n\nThe root cause of this vulnerability lies in the improper handling of the \u2018vzeroupper\u2019 instruction during speculative execution, a widely-used performance-enhancing technique employed in modern processors.\n\nOrmandy employed fuzzing and performance counters to identify specific hardware events, validating his findings using the \u201cOracle Serialization\u201d approach. This method enabled the detection of inconsistencies between the execution of a randomly generated program and its serialized oracle, leading to the discovery of CVE-2023-20593 in Zen2 CPUs.\nSee Also: So you want to be a hacker? Offensive Security, Bug Bounty Courses Zenbleed PoCWith an optimized exploit for the flaw, the researcher successfully demonstrated how sensitive data from various system operations, including those within virtual machines, isolated sandboxes, and containers, could be leaked.\n\n\u201cI found a variant that can leak about 30 kb per core, per second. This is fast enough to monitor encryption keys and passwords as users login!,\u201d elaborated Ormandy in a technical write-up.\n\nAfter notifying AMD about the flaw on May 15, 2023, the researcher has now published a proof-of-concept (PoC) exploit for CVE-2023-20593, impacting all operating systems running on Zen 2 CPUs.\nFirst big result from our new CPU research project, a use-after-free in AMD Zen2 processors! \ud83d\udd25 AMD have just released updated microcode for affected systems, please update! https://t.co/NVPWFpVopz pic.twitter.com/HgKwu9w8Av\n\n\u2014 Tavis Ormandy (@taviso) July 24, 2023\nThe vulnerability affects numerous AMD CPUs built on the Zen 2 architecture, including Ryzen 3000 (\u201cMatisse\u201d), Ryzen 4000U/H (\u201cRenoir\u201d), Ryzen 5000U (\u201cLucienne\u201d), Ryzen 7020, and high-end ThreadRipper 3000 and Epyc server (\u201cRome\u201d) processors.\n\nAMD has released an updated microcode to address the issue, and users are strongly advised to apply the fix or await BIOS upgrades from their computer vendors.\n\u200b\nTrending: Unlocking Windows System Resource Utilization for Digital Forensics Analysis with SRUM Dump Trending: Digital Forensics Tool: ScrapPy\nOrmandy suggests an alternative mitigation method involving setting the \u201cchicken bit\u201d to DE_CFG[9], though this may lead to a drop in CPU performance.\n\nDetection of exploitation is challenging, as the improper usage of \u2018vzeroupper\u2019 does not require elevated privileges or special system calls, making the Zenbleed exploit stealthy and potentially hard to trace.\n\nFor regular users, the practical impact of Zenbleed is relatively low, as exploiting it requires local access to the target system and a high level of expertise. Nonetheless, maintaining up-to-date systems with the latest security patches and BIOS updates is crucial to mitigate potential risks.\nTrending: WormGPT: Unleashing the Dark Side of Generative AI for Cybercrime\nAre u a security researcher? Or a company that writes articles or write ups about Cyber Security, Offensive Security (related to information security in general) that match with our specific audience and is worth sh[...]", "creation_timestamp": "2026-09-04T11:00:05.053985Z"}