AMD "INCEPTION" CPU Vulnerability Disclosed

AMD has kicked off a busy Patch Tuesday by disclosing INCEPTION, a new speculative side channel attack affecting Zen 3 and Zen 4 processors that require new microcode while prior Zen CPUs require a kernel-based solution.

AMD-SB-7005 "Return Address Security Bulletin" outlines this new speculative side channel attack affecting recent EPYC and Ryzen processors.

AMD's statement to Phoronix on the matter is:

AMD has received an external report titled ‘INCEPTION’, describing a new speculative side channel attack. AMD believes ‘Inception’ is only potentially exploitable locally, such as via downloaded malware, and recommends customers employ security best practices, including running up-to-date software and malware detection tools. AMD is not aware of any exploit of ‘Inception’ outside the research environment, at this time.

AMD recommends customers apply a µcode patch or BIOS update as applicable for products based on “Zen 3” and “Zen 4” CPU architectures. No µcode patch or BIOS update is necessary for products based on “Zen” or “Zen 2” CPU architectures because these architectures are already designed to flush branch type predictions from the branch predictor.

AMD plans to release updated AGESA™ versions to Original Equipment Manufacturers (OEMs), Original Design Manufacturers (ODMs) and motherboard manufacturers listed in the AMD security bulletin. Please refer to your OEM, ODM or motherboard manufacturer for a BIOS update specific to your product.

AMD says any performance impact is likely to be minimal. I'll be running some benchmarks in any case. I wasn't briefed in advance on this vulnerability so just this quick article for now.

More details on this new AMD processor vulnerability at AMD.com.