Despite AMD CPU patch, researchers highlight more exploits could be incoming

Computer scientists from TU Dresden have shown it's possible to produce a Meltdown-like vulnerability in AMD's processors. In case you don't remember, AMD's chips were famously unaffected by the original Meltdown CPU exploits, while Intel's were, so this is maybe surprising news. The new exploit was demonstrated on a Ryzen 7 2700X CPU as well as with Epyc 7262 and Threadripper 2990WX silicon.

Don't worry though, AMD has developed a technique to mitigate the problem and has recommendations as to how software vendors can analyse their code for such vulnerabilities. AMD also stated how newer, and future processors support additional security features to protect against such exploits.

AMD was given time to get a solution in place, because the researchers, Saidgani Musaev and Christof Fetzer, originally shared the vulnerability with AMD back in October 2020 but have only just reported their findings. Thus giving AMD plenty of time to mitigate the problem. AMD referenced the vulnerability in a security bulletin, AMD-SB-1010.

The original research paper, "Transient Execution of Non-Canonical Accesses", showed that Zen+ and Zen 2 processors were vulnerable to specific code sequences that may lead to data leakage. It has since been shown to affect all of AMD's CPUs. This is a different method to that used by Meltdown, which relied on fetching data from the L1 data cache, but the outcome is "very similar to Meltdown-type behaviour."

The paper does highlight that AMD's design decisions limit the exploitability of these flaws, especially when compared to Intel's CPUs, but that, "it may be possible to use them to amplify other microarchitectural attacks." So not all good news then.

Since Spectre and Meltdown appeared on the scene, both Intel and AMD have been keen to beef up the security of their processors. And it looks like such exploits aren't about to disappear any time soon.