Ciphertext Side Channels on AMD SEV

Bulletin ID: AMD-SB-1033
Potential Impact: Data leakage
Severity: Medium

Summary

AMD received notification of a potential security vulnerability where data in specific cryptographic algorithms can be inferred in a SEV guest by monitoring the ciphertext values over time.  Researchers from the Institute for IT-Security University of Luebeck and The Ohio State University will present their paper titled “A Systematic Look at Ciphertext Side Channels on AMD SEV-SNP” at the 43^rd IEEE Symposium on Security and Privacy scheduled for May 23-25, 2022.

CVE Details

CVE-2021-46744

An attacker with access to a malicious hypervisor may be able to infer data values used in a SEV guest on AMD CPUs by monitoring ciphertext values over time.

Affected Products

1st/2nd/3rdGen AMD EPYC™ Processors

AMD EPYC™ Embedded Processors

Mitigation

AMD has provided guidance via an updated paper located here: TECHNICAL GUIDANCE FOR MITIGATING EFFECTS OF CIPHERTEXT VISIBILITY UNDER AMD SEV

As of the date of this notice, AMD is not aware of any active exploits in the wild of CVE-2021-46744 on AMD products. We continue to look for ways to make our products more secure, including working closely with partners, academics, researchers, and end-users in the ecosystem.

Acknowledgement

AMD thanks the following for reporting this issue and for engaging in coordinated vulnerability disclosure.

• Professor Yinqian Zhang from Southern University of Science and Technology (SUSTech), his Ph.D. student Mengyuan Li from Ohio State University as well as Professor Radu Teodorescu from Ohio State University
• Luca Wilke, Jan Wichelmann and Professor Thomas Eisenbarth from the University of Lübeck

References  

TECHNICAL GUIDANCE FOR MITIGATING EFFECTS OF CIPHERTEXT VISIBILITY UNDER AMD SEV

Revisions

DISCLAIMER

The information contained herein is for informational purposes only and is subject to change without notice. While every precaution has been taken in the preparation of this document, it may contain technical inaccuracies, omissions, and typographical errors, and AMD is under no obligation to update or otherwise correct this information. Advanced Micro Devices, Inc. makes no representations or warranties with respect to the accuracy or completeness of the contents of this document and assumes no liability of any kind, including the implied warranties of non-infringement, merchantability or fitness for particular purposes, with respect to the operation or use of AMD hardware, software or other products described herein. Any computer system has risks of security vulnerabilities that cannot be completely prevented or mitigated. No license, including implied or arising by estoppel, to any intellectual property rights is granted by this document. Terms and limitations applicable to the purchase or use of AMD’s products are as set forth in a signed agreement between the parties or in AMD's Standard Terms and Conditions of Sale.

AMD, the AMD Arrow logo, and combinations thereof are trademarks of Advanced Micro Devices, Inc. Other product names used in this publication are for identification purposes only and may be trademarks of their respective companies.

© 2022 Advanced Micro Devices, Inc. All rights reserved.