August 08, 2023
Co-authored on the Google Online Security Blog, this post details the coordinated disclosure, ecosystem impact, and collaborative industry remediation of two critical processor vulnerabilities uncovered by Google security researchers: Downfall (CVE-2022-40982, discovered by Daniel Moghimi) and Zenbleed (CVE-2023-20593, discovered by Tavis Ormandy).
Key Takeaways from the Disclosure
- Downfall (CVE-2022-40982): Stems from memory optimization features in Intel Core processors (6th through 11th generations) associated with the SIMD vectorized
Gatherinstruction (AVX2andAVX-512). The vulnerability allows unprivileged local attackers, untrusted web applets, or co-located virtual machines to extract internal hardware register contents—stealing encryption keys, credentials, and confidential user data across security boundaries. - Zenbleed (CVE-2023-20593): Affects AMD Zen 2 microarchitectures, where speculative execution interacting with register allocation logic could lead to cross-process floating-point and vector register leakage at throughputs of up to 30 kB/s per core.
- Complex Optimization vs. Security Boundaries: Both vulnerabilities highlight how modern performance optimizations (such as speculative execution, simultaneous multithreading, and aggressive memory gathering) can blur software isolation boundaries.
- Coordinated Cross-Industry Defense: Through coordinated disclosure, Google researchers worked alongside Intel, AMD, cloud service providers, and Linux distribution maintainers to develop, test, and deploy firmware updates and microcode mitigations prior to public disclosure, protecting billions of personal computers and cloud servers worldwide.
📖 Read the full announcement on the Google Security Blog:
Downfall and Zenbleed: Googlers helping secure the ecosystem
🌐 Project Website: Downfall Attacks (downfall.page)