Cachewarp

CacheWarp, a significant vulnerability (CVE-2023-20592) in software design and implementation, was disclosed on November 14. This flaw allows malicious actors to exploit AMD Secure Encrypted Virtualization (SEV)-protected virtual machines (VMs) to escalate privileges and gain remote code execution. The vulnerability affects first through third-generation EPYC processors, excluding the fourth generation. On the same day of the disclosure, AMD released a microcode patch for third-generation EPYC chips to address the issue. The exploitation of CacheWarp enables attackers to manipulate return addresses on the stack, altering the control flow of a targeted program. Additionally, it can be used to undo data modifications, fooling the system into believing it has an outdated status. The vulnerability was found in the INVD instruction, which could lead to a loss of SEV-ES and SEV-SNP guest VM memory integrity, according to an AMD security advisory. A research team led by Michael Schwarz from the CISPA Helmholtz Centre for Information Security published an academic paper on the vulnerability, titled "CacheWarp: Software-based fault injection using selective state reset," which has been accepted for the USENIX Security conference 2024. They also created a dedicated website to provide information on CacheWarp and shared video demos demonstrating how it can be used to gain root privileges or bypass OpenSSH authentication.