AMD Warns of New Spectre V2 Flaw Affecting Zen 1 to Zen 4 Processors

AMD issued security bulletin AMD-SB-7061, warning that a new Spectre V2 attack affects processors built on the Zen 1 through Zen 4 architectures, spanning the Ryzen 1000 through Ryzen 7000/8000G series. The attack is not remotely exploitable; it requires an attacker to already be executing code with ordinary user privileges on the target Linux system. Systems at higher risk include shared servers, cloud environments, and devices running untrusted local applications.

The research team completed full validation on a Ryzen 7 4700G, with all protective mechanisms such as KASLR and Safe RET enabled. The attacker successfully located the Linux kernel's random memory position in all 10 attempts, with a median time of 548 seconds. Subsequently, the team read kernel memory at an average rate of 5.47 bytes per second with 91.97% accuracy. In 5 of 10 tests, they found and read the /etc/shadow file—which stores Linux account password hashes and account information—within an average of 18 minutes.

The attack exploits Safe RET, the standard Linux mitigation for speculative return stack overflow (SRSO), which clears the CPU return stack buffer before kernel returns. By injecting an interrupt, the attacker exploits an extremely short window of only two instructions between Safe RET's cleanup and the actual return. Through precise timing, they trigger a hardware interrupt that diverts the processor's original flow, forcing it to execute the interrupt handler and re-influence prediction state that had already been cleared. The attack also evicts the Safe RET sequence from the CPU cache to lengthen the execution time of those two instructions. Combined with the earlier Inception attack, this allows the return stack buffer to be trained to an attacker-chosen target on Zen 2.

A Linux patch, titled "x86/bugs: Make Safe-RET robust against interrupt injection," has been developed and merged into the Linux kernel. Linux users running processors based on Zen 1 through Zen 4 architectures are advised to install the kernel and security updates.