Executive brief
A security vulnerability exists in the AMD Secure Processor (ASP) found in several generations of Ryzen and Threadripper desktop processors. A highly privileged attacker with local access could exploit timing differences in how the processor handles security checks to bypass data integrity protections. This could allow an attacker to provide unauthorized input that the system incorrectly treats as authentic, potentially compromising the integrity of secure operations.
Technical details
This vulnerability is classified as an observable timing discrepancy (CWE-208) within the AMD Secure Processor (ASP). The flaw allows a local attacker with high privileges to perform a side-channel brute-force attack against the Hash-based Message Authentication Code (HMAC) by measuring execution time differences. If successful, the attacker can forge arbitrary message inputs that the ASP will accept as valid, leading to a loss of data integrity. The attack requires local access and high privileges (PR:H) and has high complexity (AC:H). AMD has released updated AGESA firmware versions to mitigate this issue across affected Ryzen and Threadripper product lines.
Affected products
- AMD Ryzen 3000 Series Desktop Processors Affected prior to ComboAM4 1.0.0.E / ComboAM4v2PI 1.2.0.CA
- AMD Ryzen 5000 Series Desktop Processors Affected prior to ComboAM4v2PI 1.2.0.CA
- AMD Ryzen Threadripper 3000 Series Processors Affected prior to CastlePeakPI-SP3r3 1.0.0.C
- AMD Ryzen Threadripper PRO 3000WX Series Processors Affected prior to CastlePeakWSPI-sWRX8 1.0.0.E
- AMD Ryzen Threadripper PRO 5000 WX-Series Processors Affected prior to ChagallWSPI-sWRX8 1.0.0.9
Timeline
- 2026-06-26: advisory: NVD and AMD published the vulnerability details.