Google Cloud Warns Three AMD Turin CPU Flaws Could Leak Data Across Processes in VMs
AI-summarised brief · reviewed before publication
Google Cloud announced that its virtual machines powered by AMD Turin (Zen 5) processors are vulnerable to three Transient Scheduler Attacks (TSAs). The flaws—TSA‑SQ (CVE‑2024‑36350), TSA‑L1 (CVE‑2024‑36357), and a new TSA‑Fill (CVE‑2026‑0004)—could allow code running on the same core to read data from other processes or the kernel. A guest‑OS patch and a stop‑and‑start reboot are required for affected C4D, N4D, H4D, Z4D, and G4 series, including bare‑metal instances. Google has applied mitigations between VMs and between VMs and the host, but no exploitation has been reported. AMD notes that Zen 5 CPUs are impacted differently from earlier EPYC models, and recommends firmware and OS updates for full protection. The issue is rated Medium by Google and classified as a local attack with high complexity and low privilege requirements.
💡 Why It Matters
- · The vulnerabilities expose a new class of side‑channel attacks that can bypass VM isolation, threatening data confidentiality in cloud environments.
- · Prompt patching is essential to prevent potential cross‑process data leakage in shared infrastructure.
