Google Cloud has issued a crucial alert concerning vulnerabilities identified in AMD Turin processors, emphasizing the need for immediate guest OS patches and a stop-and-start procedure for virtual machines (VMs) to mitigate potential data leaks. These vulnerabilities, classified as side-channel flaws, pose risks of data inference from other processes or the kernel within the same processor core.
Details of the AMD Turin CPU Flaws
The specific VM series affected include C4D, N4D, H4D, Z4D, and G4, encompassing bare-metal instances of C4D and Z4D. AMD Turin, also known as the fifth-generation EPYC processors, is subjected to three identified flaws: TSA-SQ (CVE-2024-36350), TSA-L1 (CVE-2024-36357), and a new flaw, CVE-2026-0004. These vulnerabilities, described as Transient Scheduler Attacks (TSA), allow attackers with code execution capabilities to infer sensitive data from the processor’s L1 data cache.
The Xen Project, responsible for the Xen hypervisor, labels this new flaw as TSA-Fill, revising previous statements regarding the immunity of Zen 5 CPUs to TSA-SQ and TSA-L1 flaws. Google rates the vulnerabilities as Medium in severity, while AMD notes the high attack complexity but low privilege requirement for exploitation.
Recommended Actions for Google Cloud Users
Google’s security bulletin outlines specific steps for users to protect their systems. For VMs, users should apply the OS vendor’s fix upon availability and perform a stop-and-start procedure to activate the mitigations. Bare metal instance operators should similarly apply vendor-supplied updates. Hypervisors within VMs require the same treatment, with users advised to restart their VMs following the updates. For Google Kubernetes Engine (GKE) users, updated node images will incorporate the necessary changes, though Cloud Run services remain unaffected.
Users operating older AMD processors such as Rome, Milan, and Genoa were previously given similar stop-and-start instructions. However, Google has not provided a method for users to verify when the CPU information update has been applied to their VMs.
Impact and Future Outlook
AMD has indicated that complete mitigation of these vulnerabilities on Turin servers requires both platform firmware and OS updates. This process may impact system performance, necessitating careful consideration by administrators regarding the balance between security risks and workload efficiency. The Xen Project has released hypervisor patches, and relevant microcode updates have been integrated into linux-firmware since September 23.
These developments underscore the ongoing challenges in cloud security and the importance of staying informed about potential vulnerabilities. As the situation evolves, users are encouraged to remain vigilant and apply necessary updates promptly to safeguard their systems.
