Update soon! AMD warns of new vulnerability that reads password files in 18 minutes: Zen 1 to Zen 4 are all affected

According to fast technology news on August 9, AMD recently issued security bulletin AMD-SB-7061, warning of a new Specter V2 attack that affects Zen 1 to Zen 4 architecture processors (roughly covering the Ryzen 1000 to Ryzen 7000/8000G series). The vulnerability was discovered by Daniël Trujillo and Mengjia Yan, researchers at the MIT Computer Science and Artificial Intelligence Laboratory. The research team completed a complete attack demonstration on Zen 2 under Linux and believed that Zen 3 and Zen 4 could also be breached. This attack is not a remote intrusion and requires the attacker to execute code with ordinary user rights on the target Linux system. The risk is higher for shared servers, cloud systems and devices running untrusted local applications. The research team completed a complete verification on Ryzen 7 4700G. Protection mechanisms such as KASLR and Safe RET were all turned on. The attacker successfully located the random location of the Linux kernel in 10 attempts, with a median time of 548 seconds. It then read the kernel memory at an average speed of 5.47 bytes/second and an accuracy of 91.97%. Five of the 10 tests found and read the /etc/shadow file within an average of 18 minutes. This file stores Linux account password hashes and account information. In terms of attack principle, Safe RET is Linux's standard protection mechanism against speculative return stack overflow (SRSO), which cleans the CPU return stack buffer before the kernel returns. Interrupt injection takes advantage of the extremely short window of only two instructions between Safe RET cleanup and actual return. It triggers hardware interrupts through precise timing, causing the processor to interrupt the original process, execute the interrupt handler, and re-affect the previously cleared prediction state. The attack also lengthens the execution time of these two instructions by clearing the Safe RET sequence from the CPU cache. In conjunction with the previous Inception attack, the return stack buffer can be trained on Zen 2 to the attacker's designated target. There are currently patches under Linux