CVE-2023-20588: 
vulnerability analysis and mitigation

CVE-2023-20588 is a vulnerability discovered in AMD processors with Zen1 microarchitecture where a division-by-zero error can potentially return speculative data, leading to loss of confidentiality. The vulnerability was identified in August 2023 and affects AMD Zen1 processors, including Datacenter AMD EPYC 7001 Processors (AMD Bulletin).

The vulnerability exists in the Zen1 microarchitecture where there is one divider in the pipeline which services uops from both threads. In the case of a division-by-zero (#DE) exception, the latched result from the previous DIV instruction to execute will be forwarded speculatively. This creates a covert channel that allows two threads to communicate without system calls and enables userspace to obtain the result of the most recent DIV instruction executed (even speculatively) in the core, which can be from a higher privilege context. The vulnerability has been assigned a CVSS v3.1 Base Score of 5.5 (MEDIUM) with vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N (NVD).

An attacker might be able to infer data from a different execution context on the same CPU core, potentially leading to information disclosure of sensitive data. This vulnerability is particularly concerning in cloud environments where AMD EPYC 7001 series processors are used, such as in AWS T3a instances (Xen Advisory).

The primary mitigation involves kernel and hypervisor patches that overwrite the buffer in the divider on the return-to-guest path. However, the fix is only fully effective when SMT (Simultaneous Multi-Threading) is disabled. Linux kernel implemented a fix by performing an innocuous division on every exit to userspace to prevent leaking old data from kernel space. For Xen hypervisor, system administrators are required to risk-assess their workload and choose whether to enable or disable SMT (Xen Advisory).

The vulnerability has received significant attention in the virtualization community, particularly among Xen users. Security researchers have noted that the vulnerability is especially concerning for cloud environments using AMD Zen1 processors. AMD has acknowledged the issue but has not expressed plans to provide a microcode fix (Openwall Discussion).