AMD recently released a security advisory, AMD-SB-7061, warning of a new Spectre V2 attack that affects processors with Zen 1 to Zen 4 architectures, covering the Ryzen 1000 to Ryzen 7000/8000G series. The vulnerability was discovered by researchers at MIT's Computer Science and Artificial Intelligence Laboratory. The research team completed a full attack demonstration on a Zen 2 architecture processor in a Linux environment and believes that processors with Zen 3 and Zen 4 architectures may also be affected. Attackers need to execute code with regular user privileges on the target Linux system, posing a higher risk to shared servers, cloud systems, and devices running untrusted local applications. The research team validated the attack on a Ryzen 7 4700G. Despite the activation of protection mechanisms such as KASLR and Safe RET, the attackers successfully located random positions in the Linux kernel, with a median time of 548 seconds, reading kernel memory at a speed of 5.47 bytes per second on average with 91.97% accuracy. In 10 tests, they successfully read the /etc/shadow file storing Linux account password hashes in an average of 18 minutes in 5 instances. The attack principle exploits an extremely short time window in the Safe RET protection mechanism, triggering hardware interrupts through precise timing to cause the processor to interrupt its original process, execute the interrupt handler, and re-influence the previously cleaned prediction state. To address this security threat, a patch named x86/bugs: Make Safe-RET robust against interrupt injection is already available for Linux and has been incorporated into the Linux kernel. It is recommended that Linux users using processors with Zen 1 to Zen 4 architectures promptly install kernel and security updates.
