Executive brief
A vulnerability in certain AMD processors could allow an attacker with local access to bypass security barriers designed to protect sensitive data. By exploiting how the processor handles specific instructions, an attacker could potentially gain unauthorized access to information stored in the system's memory. This could lead to the exposure of confidential data such as passwords or encryption keys.
Technical details
This vulnerability is a protection mechanism failure (CWE-693) involving the improper enforcement of the LFENCE serialization property in AMD processors. LFENCE is an instruction used to create a memory fence, ensuring that all previous instructions are globally visible before any subsequent instructions. Due to this flaw, an attacker with local access and low privileges can bypass speculation barriers. This allows for side-channel attacks that can leak sensitive data from memory that should otherwise be protected by speculative execution guards. The attack requires specific timing and architectural conditions (High Attack Complexity) to be successful.
Affected products
- AMD Processors
Timeline
- 2026-05-13: disclosed: Initial disclosure by AMD and NVD publication.