An issue in “Zen 2” CPUs, under specific microarchitectural circumstances, may allow an attacker to potentially access sensitive information. Under specific microarchitectural circumstances, a register in “Zen 2” CPUs may not be written to 0 correctly. This may cause data from another process and/or thread to be stored in the YMM register, which may allow an attacker to potentially access sensitive information. Refer: https://www.amd.com/en/resources/product-security/bulletin/amd-sb-7008.html
Affected Products: “Zen 2” Architecture-based Client and Server platforms Desktop AMD RyzenTM 3000 Series Processors AMD RyzenTM PRO 3000 Series Processors AMD RyzenTM ThreadripperTM 3000 Series Processors AMD RyzenTM 4000 Series Processors with RadeonTM Graphics AMD RyzenTM PRO 4000 Series Desktop Processors Mobile AMD RyzenTM 5000 Series Processors with RadeonTM Graphics AMD RyzenTM 7020 Series Processors with RadeonTM Graphics Datacenter AMD EPYCTM 7002 Processors
Hello, I'm not sure what info are needed to move forward and issue a linux-firmware package including the upstream fix. The technical details of the issue are here [0] The upstream fix is here [1] Its weird that the Red Hat related page[2] states that none of RHEL versions are affected. Youssef Ghorbal [0] https://lock.cmpxchg8b.com/zenbleed.html [1] https://git.kernel.org/pub/scm/linux/kernel/git/firmware/linux-firmware.git/commit/?id=0bc3126c9cfa0b8c761483215c25382f831a7c6f [2] https://access.redhat.com/security/cve/cve-2023-20593
https://access.redhat.com/security/cve/cve-2023-20593 lists kernel packages as "not affected", which is both true and completely irrelevant: CVE-2023-20593 is not a kernel issue (even though some kernel-side mitigations exist), it's a CPU problem and the fix is a microcode update. Could we please get a linux-firmware update that contains the updated µcode in https://git.kernel.org/pub/scm/linux/kernel/git/firmware/linux-firmware.git/commit/?id=0bc3126c9cfa0b8c761483215c25382f831a7c6f? Debian already released an updated amd64-microsode package 2 days ago, so with Red Hat still not having even correctly assessed the issue, let alone provided any fix or mitigation, it's hard for customers to understand the value of paying an Enterprise support license in the hope of getting timely security updates. Or support.
Created kernel tracking bugs for this issue: Affects: fedora-all [bug 2226819]
This was fixed for Fedora with the 6.4.6 stable kernel updates.
If this was fixed in the Fedora 6.4.6 kernel then: - How come the release nodes for this kernel (or newer kernels up to 6.4.8) make no mention of it - How was this fixed in a kernel update when this is actually a CPU microcode issue? Was the "chicken bit" workaround integrated into the kernel? The actual microcode fix should be released as part of a new linux-firmware-20230804-152 package, which right now for Fedora is still in "Testing". https://packages.fedoraproject.org/pkgs/linux-firmware/linux-firmware/ When can we expect this updated firmware package, to actually fix this issue, to be released for RHEL? After all this CVE has been public since the 24th of July.
So Fedora is getting security fixes faster that RHEL now? Seriously what's the point of beeing a paying RHEL curtomer? What's the plan for this to be fixed in RHEL? Are we talking day? weeks?
This issue has been addressed in the following products: Red Hat Enterprise Linux 7.4 Advanced Update Support Via RHSA-2023:4699 https://access.redhat.com/errata/RHSA-2023:4699
This issue has been addressed in the following products: Red Hat Enterprise Linux 7.6 Advanced Update Support Via RHSA-2023:4696 https://access.redhat.com/errata/RHSA-2023:4696
This issue has been addressed in the following products: Red Hat Enterprise Linux 8.6 Extended Update Support Via RHSA-2023:4789 https://access.redhat.com/errata/RHSA-2023:4789
This issue has been addressed in the following products: Red Hat Enterprise Linux 7 Via RHSA-2023:4821 https://access.redhat.com/errata/RHSA-2023:4821
This issue has been addressed in the following products: Red Hat Enterprise Linux 7 Via RHSA-2023:4819 https://access.redhat.com/errata/RHSA-2023:4819
This issue has been addressed in the following products: Red Hat Enterprise Linux 9 Via RHSA-2023:5068 https://access.redhat.com/errata/RHSA-2023:5068
This issue has been addressed in the following products: Red Hat Enterprise Linux 9 Via RHSA-2023:5091 https://access.redhat.com/errata/RHSA-2023:5091
This issue has been addressed in the following products: Red Hat Enterprise Linux 9 Via RHSA-2023:5069 https://access.redhat.com/errata/RHSA-2023:5069
This issue has been addressed in the following products: Red Hat Enterprise Linux 8 Via RHSA-2023:5245 https://access.redhat.com/errata/RHSA-2023:5245
This issue has been addressed in the following products: Red Hat Enterprise Linux 8 Via RHSA-2023:5255 https://access.redhat.com/errata/RHSA-2023:5255
This issue has been addressed in the following products: Red Hat Enterprise Linux 8 Via RHSA-2023:5244 https://access.redhat.com/errata/RHSA-2023:5244
This issue has been addressed in the following products: Red Hat Enterprise Linux 7.7 Advanced Update Support Via RHSA-2023:5419 https://access.redhat.com/errata/RHSA-2023:5419
This issue has been addressed in the following products: Red Hat Enterprise Linux 8.2 Advanced Update Support Red Hat Enterprise Linux 8.2 Update Services for SAP Solutions Red Hat Enterprise Linux 8.2 Telecommunications Update Service Via RHSA-2023:5591 https://access.redhat.com/errata/RHSA-2023:5591
This issue has been addressed in the following products: Red Hat Enterprise Linux 9.0 Extended Update Support Via RHSA-2023:5607 https://access.redhat.com/errata/RHSA-2023:5607
This issue has been addressed in the following products: Red Hat Enterprise Linux 7.7 Advanced Update Support Via RHSA-2023:7244 https://access.redhat.com/errata/RHSA-2023:7244
This issue has been addressed in the following products: Red Hat Enterprise Linux 9.0 Extended Update Support Via RHSA-2023:7389 https://access.redhat.com/errata/RHSA-2023:7389
This issue has been addressed in the following products: Red Hat Enterprise Linux 9.0 Extended Update Support Via RHSA-2023:7382 https://access.redhat.com/errata/RHSA-2023:7382
This issue has been addressed in the following products: Red Hat Enterprise Linux 8.6 Extended Update Support Via RHSA-2023:7401 https://access.redhat.com/errata/RHSA-2023:7401
This issue has been addressed in the following products: Red Hat Enterprise Linux 7 Via RHSA-2023:7513 https://access.redhat.com/errata/RHSA-2023:7513
This issue has been addressed in the following products: Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support Red Hat Enterprise Linux 8.4 Update Services for SAP Solutions Red Hat Enterprise Linux 8.4 Telecommunications Update Service Via RHSA-2023:7551 https://access.redhat.com/errata/RHSA-2023:7551
This issue has been addressed in the following products: Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support Red Hat Enterprise Linux 8.4 Update Services for SAP Solutions Red Hat Enterprise Linux 8.4 Telecommunications Update Service Via RHSA-2023:7557 https://access.redhat.com/errata/RHSA-2023:7557
This issue has been addressed in the following products: Red Hat Enterprise Linux 8.1 Update Services for SAP Solutions Via RHSA-2023:7665 https://access.redhat.com/errata/RHSA-2023:7665
This issue has been addressed in the following products: Red Hat Enterprise Linux 7.6 Advanced Update Support Via RHSA-2023:7782 https://access.redhat.com/errata/RHSA-2023:7782
This issue has been addressed in the following products: Red Hat Enterprise Linux 8.2 Telecommunications Update Service Via RHSA-2024:0402 https://access.redhat.com/errata/RHSA-2024:0402
This issue has been addressed in the following products: Red Hat Enterprise Linux 8.2 Advanced Update Support Red Hat Enterprise Linux 8.2 Update Services for SAP Solutions Red Hat Enterprise Linux 8.2 Telecommunications Update Service Via RHSA-2024:0403 https://access.redhat.com/errata/RHSA-2024:0403
This issue has been addressed in the following products: Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support Red Hat Enterprise Linux 8.4 Update Services for SAP Solutions Red Hat Enterprise Linux 8.4 Telecommunications Update Service Via RHSA-2024:0561 https://access.redhat.com/errata/RHSA-2024:0561