Speculative Leaks Security Notice

**Bulletin ID:**AMD-SB-7007 **Potential Impact:**Loss of Confidentiality **Severity:**Low

Summary

External researchers have reported that on some AMD processors a division-by-zero can potentially return speculative data.

CVE Details

Refer to Glossary for explanation of terms

Affected Products

Datacenter

AMD EPYC™ 7001 Processors

Desktop

AMD Athlon™ 3000 Series Processors with Radeon™ Graphics
AMD Ryzen™ 3000 Series Processors with Radeon™ Graphics

Mobile

AMD Athlon™ PRO 3000 Series Processors with Radeon™ Vega Graphics
AMD Ryzen™ PRO 3000 Series Processors with Radeon™ Vega Graphics

Mitigation

For affected products, AMD recommends following software development best practices. Developers can mitigate this issue by ensuring that no privileged data is used in division operations prior to changing privilege boundaries. AMD believes that the potential impact of this vulnerability is low because it requires local access.

In addition, the data that is potentially leaked may not be privileged, and an attacker does not have control of the division operation which determines that data. We also believe impact is limited to products prior to “Zen 2” based architectures and are not aware of any existing exploits based on this vulnerability.