AMD Zen 3 / Zen 4 - new exploitation method for SRSO (CVE-2023-20569): MULTI-TENANT ISOLATION: Google's security team

Impact

MULTI-TENANT ISOLATION: Google's security team demonstrated a new way to exploit the existing Inception/SRSO defect on Zen 3 and Zen 4. No new CVE was assigned and AMD asserts the original mitigations still hold. Recorded here because it is the kind of update that never reaches a patch queue: nothing to install, but your risk assessment of an already-known issue should move if the exploitation bar just dropped.

Who can reach it

Local, cross-privilege speculative execution on Zen 3 and Zen 4.

What to do

**No new action** if you already applied the original SRSO mitigations (microcode plus AGESA, MilanPI 1.0.0.C / GenoaPI 1.0.0.9 or later, plus the kernel's Safe RET). Verify that you did - read /sys/devices/system/cpu/vulnerabilities/spec_rstack_overflow across the fleet rather than assuming. Note the interaction with AMD-SB-7061 above: Safe RET, the mitigation you are relying on here, has its own open weakness.

References