Zenbleed

Zenbleed is a software vulnerability discovered in AMD Zen2 processors, as reported by Kaspersky and other security researchers. This flaw, similar to the earlier Downfall vulnerability found in modern Intel CPUs, allows unauthorized observation of data that should be secure, including cryptographic keys, runtime data, and arbitrary data. While Zenbleed cannot run directly from JavaScript, it can operate within the browser when paired with another exploit to escape the JS interpreter and run actual shellcode. The discovery of Zenbleed was widely covered in the cybersecurity community, with platforms like Hackaday and Naked Security highlighting its potential risks. The vulnerability is particularly concerning due to its ability to expose sensitive data, such as passwords and encryption keys, putting user privacy and security at risk. It is noteworthy that this flaw has been linked to the ongoing quest for CPU performance, indicating a trade-off between speed and security. In response to the discovery of Zenbleed, AMD has announced plans to release firmware patches to mitigate the vulnerability. However, until these patches are implemented, users of systems with AMD Zen2 CPUs remain at risk. One of the worst-case scenarios envisaged is the exploitation of the Zenbleed flaw directly from within the browser, which could potentially allow hackers to access and steal sensitive data.