Zenbleed CVE-2023-20593: What you need to know about the latest CPU vulnerability

If you woke up this week to news of a new CPU vulnerability affecting virtually everyone, you’re not alone. Named “Zenbleed” (CVE-2023-20593) by its reporter/discoverer Tavis Ormandy, this new vulnerability primarily targets AMD Zen CPUs and has the potential to cause substantial damage, much like previous CPU vulnerabilities such as Spectre and Meltdown.

What is Zenbleed and why should you care?

Zenbleed is an AMD Zen 2 CPU vulnerability allowing arbitrary reading of data from any cloud workload sharing the same CPU core. This includes virtual machines, containers, etc., regardless of the operating system in use.

The vulnerability isn’t environment-specific and could likely affect some cloud-based serverless workloads like AWS Lambda and Amazon EKS if they run on AMD Zen 2 CPUs. Moreover, this vulnerability doesn’t require elevated privileges for exploitation.

Though the system only leaks data during processing and an attacker cannot target or specify which data to read from areas sharing the same core, the impact can still be significant. If secrets (keys, passwords, hashes) are leaked, this could lead to unauthorized remote access.

While Zenbleed is relatively straightforward to exploit, its inherent characteristics potentially curtail its malicious applications. The inability to choose the data you wish to read potentially hampers its misuse by threat actors. We’ve discussed this extensively within the Lacework Cloud Threat Research team, arriving at a consensus that it’s unlikely to be effectively utilized by financially motivated threat actors.

However, the challenge lies in its detection. The complexity arises from the fact that the attacker doesn’t even need to be in the virtual machine to read its data; they can simply be on the host system. This property of Zenbleed allows it to circumvent traditional defenses. Consequently, our focus needs to remain on proactive mitigation and patching, given the stealthy nature of potential attacks.

To put this vulnerability into perspective, a Proof of Concept (POC) is available here. After a simple make command, you can run the created objects using ./zenbleed. Do note, however, that you will need the NASM compiler installed for this.

Zenbleed execution

Is Lacework vulnerable?

Addressing this vulnerability has been a top priority for our security team. As the Lacework platform included several instances using vulnerable AMD CPUs, we promptly moved all production services off of those vulnerable platforms. We are continuously monitoring for signs of attempted exploitation and will report any discoveries.

Identifying vulnerable machines with Lacework LQL query

To determine which machines in your environment are potentially vulnerable to Zenbleed, you can use a Lacework Query Language (LQL) query. LQL allows you to ask detailed questions about your cloud environment and security posture.

You can find a detailed guide on how to create an LQL query using the Lacework CLI here.

Alternatively, you can save the query below to a file (for example, zenbleed.yaml), and run the command: