C20/100
Vulnerability · medium
Google Cloud warns of three AMD Turin CPU side-channel flaws
Tier C · Keep an eye on it – Check if you’re affected
Who’s exposed: Google Cloud VMs running on AMD Turin CPUs
Tier C because: Hits tech teams
Reach
Attack
Damage
Fix
What to do
- Apply the guest OS patch to affected VMs
- Stop and start affected VMs to complete the protection
The Brief
- Google said three CPU side-channel flaws in AMD Turin chips could leak data across processes in VMs.
- Google Cloud VMs on AMD Turin need a guest OS patch and a stop-and-start to be protected.
- Google has already applied mitigations against attacks between VMs and between VMs and the host.
Why it matters
Customers running VMs on AMD Turin hardware on Google Cloud must patch their guest OS, because the flaws may still allow data leaks inside a VM.
The checklist behind the tier
Checklist · 1 of 10 yes
| Yes | Hits tech teams | Judgment: Google Cloud VMs running on AMD Turin chips are run and managed by developers and ops teams. |
| No | Core infrastructure | Judgment: the flaws are in AMD CPU hardware microarchitecture, not in software nearly every team runs. |
| No | Popular tool | Judgment: a CPU hardware flaw is not a framework, tool, platform, OS or package. |
| No | Exploited in the wild | The Hacker News: Google Cloud warns of the flaws and says it applied mitigations; no observed attacks reported. |
| No | Public exploit | The Hacker News: only a warning and mitigation guidance are described; no published exploit code or PoC is mentioned. |
| No | Remote, no login | The Hacker News: flaws are side-channel leaks inside VMs, which need code running in the guest, not unauthenticated network access. |
| No | Full takeover | The Hacker News: flaws may leak data across processes; no code execution or root/admin takeover is described. |
| No | Secrets exposed | The Hacker News: flaws may leak data across processes; no source reports data actually stolen or exposed. |
| No | Supply chain | The Hacker News: a CPU side-channel flaw; no compromised package, update, build pipeline or signing key is reported. |
| No | No fix yet | The Hacker News: a guest OS patch and VM stop-and-start protect against the flaws, and Google applied mitigations. |
Timeline
Google Cloud warns of three AMD Turin CPU side-channel flaws
The Hacker News
Google Cloud Warns Three AMD Turin CPU Flaws Could Leak Data Across Processes in VMs
Source
Google Cloud Warns Three AMD Turin CPU Flaws Could Leak Data Across Processes in VMs ↗ The Hacker News · 2h ago
First seen · 1 source · Full story page · How tiers are decided