Ruiyi Zhang

101 posts

Ruiyi Zhang banner
Ruiyi Zhang

Ruiyi Zhang

@Rayiizzz

Microarchitectural Security | PhD Candidate at CISPA | Ex Research Intern @Google | #StackWarp #CacheWarp

Katılım Ağustos 2019
226 Takip Edilen549 Takipçiler
Sabitlenmiş Tweet
Ruiyi Zhang
Ruiyi Zhang@Rayiizzz·
Today we reveal StackWarp: a new CPU vulnerability exploiting a synchronization bug in AMD’s stack engine across Zen 1–5 CPUs. It enables deterministic manipulation of Confidential VM's stack pointer, allowing RCE and privilege escalation via both control- and data-flow hijacking
English
18
179
1.4K
146.4K
Matthew
Matthew@CPUGenius11·
@Rayiizzz Is this patchable in a microcode update or no?
English
1
0
1
2.4K
Ruiyi Zhang
Ruiyi Zhang@Rayiizzz·
Today we reveal StackWarp: a new CPU vulnerability exploiting a synchronization bug in AMD’s stack engine across Zen 1–5 CPUs. It enables deterministic manipulation of Confidential VM's stack pointer, allowing RCE and privilege escalation via both control- and data-flow hijacking
English
18
179
1.4K
146.4K
Ruiyi Zhang
Ruiyi Zhang@Rayiizzz·
@JustWantToQ1 That's correct. As I noted in the quote, while the bug exists on Zen 1-5, it only becomes a security vulnerability for confidential VMs.
English
1
0
2
285
Voidwalker
Voidwalker@JustWantToQ1·
@Rayiizzz I don't mean to take away from your work btw. Just trying not to scare people.
English
1
0
1
314
Ruiyi Zhang
Ruiyi Zhang@Rayiizzz·
If an SMT sibling disables it, the RSP delta becomes 'frozen' and is only released to a future execution context when the bit is toggled again. While the underlying bug exists across Zen 1-5, it only poses a security risk in specific scenarios, like within confidential computing.
English
0
0
13
721
Ruiyi Zhang
Ruiyi Zhang@Rayiizzz·
To clear up some confusion: the root cause lies in the stack engine, a CPU frontend optimization that manages the Stack Pointer (RSP) to reduce backend overhead. We discovered that an undocumented MSR bit acts as a toggle for this optimization. (1/2)
Ruiyi Zhang@Rayiizzz

Today we reveal StackWarp: a new CPU vulnerability exploiting a synchronization bug in AMD’s stack engine across Zen 1–5 CPUs. It enables deterministic manipulation of Confidential VM's stack pointer, allowing RCE and privilege escalation via both control- and data-flow hijacking

English
3
4
94
9.4K
Off By One Security
Off By One Security@offby1security·
@Rayiizzz Interesting work! We'd love to have you as a guest on the Off By One Security channel to walk us through this if you'd be interested!? Viewers love the low level vulnerability research topics. @OffByOneSecurity" target="_blank" rel="nofollow noopener">youtube.com/@OffByOneSecur…
English
1
0
14
7.5K
Ruiyi Zhang
Ruiyi Zhang@Rayiizzz·
@Void_The_Null We disclosed this vulnerability to AMD in March 2025 and embargo is over as of today. AMD already released a microcode patch to mitigate it :)
English
1
0
99
4.3K
DataBoySu
DataBoySu@Void_The_Null·
@Rayiizzz Wait, is this vulnerability live? That's serious for AMD users and equally impressive that you managed to reveal it. Congrats!
English
1
0
12
4.2K
Ruiyi Zhang retweetledi
Kav
Kav@kavehrazavi·
The program for uASC'26 is online uasc.cc/program.html We have some very interesting papers which are already available, so be sure to check them out. Better yet, join us in Leuven next month to listen to the authors! Registration is still open and free but seats are limited.
English
0
4
4
687
Ruiyi Zhang retweetledi
Shweta Shinde
Shweta Shinde@shw3ta_shinde·
🔓 Heracles @acm_ccs'25: Breaking AMD’s Confidential Computing! We show that the hypervisor can read and move hardware-encrypted memory on AMD SEV-SNP. We build a chosen-plaintext oracle to leak kernel memory, auth keys, and cookies from "confidential" VMs heracles-attack.github.io
English
0
8
33
2.1K
itewqq
itewqq@lyq_sqsp·
Just defended my doctoral dissertation, I’m a f*cking Doctor now 🥵
English
3
0
23
2K
Ruiyi Zhang retweetledi
Kav
Kav@kavehrazavi·
I am chairing the second edition of the microarchitecture security conference (uASC'26). Paper deadline for the first cycle is July 15. Please spread the word, submit, and/or join us in charming Leuven in February 2026! More info: uasc.cc
English
1
7
15
1.5K
Ruiyi Zhang retweetledi
Seres István András
Seres István András@Istvan_A_Seres·
✅ Write constant-time crypto code ☠️ Compiler introduces timing side-channels Do Compilers Break Constant-time Guarantees? fc25.ifca.ai/preproceedings… TL;DR: Yes!🥲 👏👏👏Great work @misc0110 & team!
Seres István András tweet media
English
1
7
22
1.7K
Ruiyi Zhang retweetledi
Matteo Rizzo
Matteo Rizzo@_MatteoRizzo·
github.com/google/securit… Our newest research project is finally public! We can load malicious microcode on Zen1-Zen4 CPUs!
English
12
275
806
122.9K
Ruiyi Zhang retweetledi
Andreas Kogler
Andreas Kogler@0xhilbert·
Excited to announce the release of the Rapid Data Analysis (RDA) framework! RDA streamlines side-channel analysis with plotting, processing, and analysis tools—usable directly from the terminal or in scripts. Check it out: github.com/0xhilbert/rda #SideChannel
Andreas Kogler tweet media
English
1
9
20
2.4K

Keşfet

@CPUGenius11 @robertomasymas @weber_daniel @fth0mas @misc0110 @JustWantToQ1 @offby1security @Void_The_Null