{"id":138893,"date":"2025-07-09T23:11:55","date_gmt":"2025-07-09T21:11:55","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/ataka-tsa-privodyashhaya-k-utechke-informaczii-iz-mikroarhitekturnyh-struktur-cpu-amd"},"modified":"2025-07-09T23:11:55","modified_gmt":"2025-07-09T21:11:55","slug":"ataka-tsa-privodyashhaya-k-utechke-informaczii-iz-mikroarhitekturnyh-struktur-cpu-amd","status":"publish","type":"post","link":"https:\/\/prohoster.info\/en\/blog\/news\/ataka-tsa-privodyashhaya-k-utechke-informaczii-iz-mikroarhitekturnyh-struktur-cpu-amd","title":{"rendered":"TSA attack leads to information leakage from AMD CPU microarchitecture structures.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

AMD has revealed information about a new class of microarchitectural attacks on its processors \u2014 TSA (Transient Scheduler Attack). This attack allows an attacker to bypass CPU isolation mechanisms and determine data being processed in other contexts, such as identifying information processed at the kernel level from user space or accessing data used by another guest system from within a guest system. <\/p>\n

The vulnerabilities were discovered during the development of a toolkit created by researchers from Microsoft and the Swiss Federal Institute of Technology Zurich for stress-testing microarchitectural isolation between different access control domains, such as the kernel, virtual machines, and processes. <\/p>\n

The attack method is based on the execution time dependency of certain instructions on the state of microarchitectural structures. When the processor expects a quick completion of a data read instruction from memory (for example, assuming the data is in the L1 cache), but fails to successfully retrieve the data, a state of 'false completion' of the instruction arises. At this point, even before this state is determined, the processor may schedule speculative execution of other operations that depend on the result of the memory load instruction. <\/p>\n

Since the load has not been completed, the associated data is deemed invalid by the processor, and the load operation is retried later. Dependent operations are also retried after the correct data becomes available. The pipeline flush after executing the instruction for which a 'false completion' state has been recorded does not occur, allowing incorrect data to be redirected into dependent operations. <\/p>\n

Executing such operations does not modify the state of the cache and TLB (Translation Lookaside Buffer), meaning that the data cannot be retrieved using traditional cache state determination methods. However, this data does influence the timing of other instructions. Timing analysis can be exploited as a source of information leakage from microarchitectural structures left behind after speculative execution of other operations. <\/p>\n

Depending on the source of residual data extraction, two vulnerabilities have been identified: <\/p>\n