PT-2022-12915 · Amd · Amd Zen 1+2

Andreas Kogler + 7 · Published 2022-08-09 · Updated 2022-08-22 · CVE-2021-46778

Positive Technologies (AI Summary)

CVSS v3.1

5.6

Medium

Base vector

AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions AMD CPU microarchitectures codenamed “Zen 1”, “Zen 2” and “Zen 3” that use simultaneous multithreading (SMT)

Description The issue is related to execution unit scheduler contention, which may lead to a side channel vulnerability. By measuring the contention level on scheduler queues, an attacker may potentially leak sensitive information. This vulnerability, known as SQUIP, affects AMD processors and allows an attacker to determine data used in other processes or virtual machines or establish a hidden communication channel between them, bypassing system access control mechanisms.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Side Channel Attack

Weakness Enumeration

CWE-203

Related Identifiers

CVE-2021-46778

Affected Products

Amd Zen 1

Amd Zen 2

Amd Zen 3

References · 4

• https://amd.com/en/corporate/product-security/bulletin/amd-sb-1039 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-46778 · Security Note
• https://t.me/opennews/10419 · Telegram Post
• https://t.me/tmfeed/148756 · Telegram Post