Researchers at the Graz University of Technology and the Helmholtz Center for Information Security have released their paper on CacheWrap - the latest vulnerability affecting some previous-generation AMD EPYC CPUs. The vulnerability is named CVE-2023-20592 and affects the first-generation EPYCNaples, second-generation EPYCRome, and third-generation EPYCMilan.
learn more:
https://cachewarpattack.com/
CacheWarp exploits a vulnerability in AMD's Secure Encrypted Virtualization (SEV) technology, specifically targeting the SEV-ES (Encrypted State) and SEV-SNP (Secure Nested Paging) versions. The attack is a software-based fault injection technique that manipulates the cache of a virtual machine (VM) running under SEV. It cleverly forces the guest VM's modified cache lines to revert to their previous state. This behavior circumvents the integrity checks that SEV-SNP is designed to perform, allowing an attacker to inject faults without being detected.
Unlike attacks that rely on specific guest virtual machine vulnerabilities, CacheWarp is more versatile and more dangerous because it does not rely on the characteristics of the target virtual machine. It exploits weaknesses in the underlying architecture of AMDSEV and therefore poses a widespread threat to systems that rely on this technology for security. CacheWarp attacks can bypass strong security measures such as cryptographic virtualization, posing significant risks to data confidentiality and integrity in secure computing environments.
AMD has released an update for EPYCMilan, providing hot-loading microcode patches and updating the firmware image, which is not expected to cause any performance degradation:
https://www.amd.com/en/resources/product-security/bulletin/amd-sb-3005.html
As for the remaining generations, AMD says that because the SEV and SEV-ES features are not designed to protect guest virtual machine memory integrity and SEV-SNP is not available, the mitigation is not available for first- or second-generation EPYC processors (Naples and Rome).