It turns out that with precise scheduling, you can cause some processors to recover from a mispredicted vzeroupper incorrectly!

This technique is CVE-2023-20593 and it works on all Zen 2 class processors, which includes at least the following products:

AMD Ryzen 3000 Series Processors AMD Ryzen PRO 3000 Series Processors AMD Ryzen Threadripper 3000 Series Processors AMD Ryzen 4000 Series Processors with Radeon Graphics AMD Ryzen PRO 4000 Series Processors AMD Ryzen 5000 Series Processors with Radeon Graphics AMD Ryzen 7020 Series Processors with Radeon Graphics AMD EPYC “Rome” Processors

The bug works like this, first of all you need to trigger something called the XMM Register Merge Optimization2, followed by a register rename and a mispredicted vzeroupper. This all has to happen within a precise window to work.

We now know that basic operations like strlen, memcpy and strcmp will use the vector registers - so we can effectively spy on those operations happening anywhere on the system! It doesn’t matter if they’re happening in other virtual machines, sandboxes, containers, processes, whatever!

This works because the register file is shared by everything on the same physical core. In fact, two hyperthreads even share the same physical register file.

Total players: 3338

Based on python

Christopher Arthur Lattner (born 1978) is an American computer scientist, former Google and Tesla employee[1] and co-founder of LLVM, Clang compiler, MLIR compiler infrastructure[2] and the Swift programming language. As of 2023, he is the co-founder and CEO of Modular AI, an artificial intelligence platform for developers.[3][4] Before founding Modular AI, he worked as the President of Platform Engineering, SiFive[5][6][7] after two years at Google Brain.[8] Prior to that, he briefly served as Vice President of Autopilot Software[9] at Tesla, Inc. and worked at Apple Inc. as Senior Director of the Developer Tools department, leading the Xcode, Instruments, and compiler teams.[10][1