AMD EPYC and Ryzen Processors LFENCE Serialization Vulnerability Allowing Speculation Barrier Bypass

A vulnerability exists in certain AMD EPYC and Ryzen processors due to improper enforcement of the LFENCE serialization property. This flaw may enable an attacker to bypass speculation barriers, potentially leading to the disclosure of sensitive information and a loss of confidentiality. Affected processors include AMD EPYC 4004, 8004, 9004, and 9005 series, as well as AMD Ryzen 7000 and 8000 series desktop processors, AMD Ryzen 6000 series mobile processors, and AMD Ryzen embedded processors.

Impact

Exploitation of this vulnerability could result in a bypass of speculation barriers, allowing for the potential disclosure of sensitive information.

Remediation

Users are advised to update to the Platform Initialization (PI) firmware versions ComboAM5PI_1.0.0.a, ComboAM5PI_1.1.0.3c, or ComboAM5PI_1.2.0.3, depending on their specific processor series. For AMD EPYC embedded processors, the recommended version is EmbGenoaPI-SP5 1.0.0.D.