Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Tue, 25 Jul 2023 12:01:33 +0200
From: Solar Designer <>
Subject: Re: CVE-2023-20593: A use-after-free in AMD Zen2 Processors

On Mon, Jul 24, 2023 at 07:28:18AM -0700, Tavis Ormandy wrote:
> Hello, this is CVE-2023-20593, a use-after-free in AMD Zen2 processors.

An impressive finding, indeed!

On a related note:

A few months earlier, Tavis found a _different_ AMD Zen1/Zen2 bug, which
turned out to have already been known and patched in AMD microcode
updates for many affected parts (but apparently not all).  There's also
a kernel level workaround, which was included into Linux in response to
Tavis' rediscovery of that issue.  Here are the links for that other
issue/fix, for distros to double-check they're fixing this one as well:

x86: AMD Zen2 ymm registers rolling back (Feb 21, 2023)

x86/CPU/AMD: Disable XSAVES on AMD family 0x17 (Mar 8, 2023)

Once again, it's a different bug - not the one that this oss-security
thread is mainly about - but both have cross-process security impact,
affect similar AMD CPUs, and need to be taken care of by similar means
(microcode updates or/and disabling of affected CPU features in the


Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.