Device
Inside AMD Zen Hardware Security: Technical Analysis of Cross-Core NoC Covert Channels, SEV-SNP Reverse Map Corruption, and ASP Firmware Advisories
On November 10, 2026, AMD published security disclosures detailing cross-core covert channels on Zen on-chip interconnects (AMD-SB-7076) and Rowhammer-induced Reverse Map Table (RMP) corruption in Secure Encrypted Virtualization (AMD-SB-3064). The findings demonstrate cross-VM timing leaks and confidential computing memory risks across enterprise EPYC and Ryzen processors. Here is the microarchitectural analysis, telemetry benchmarks, and defensive mitigation guide.
12 min read
Inside AMD Zen Hardware Security: Technical Analysis of Cross-Core NoC Covert Channels, SEV-SNP Reverse Map Corruption, and ASP Firmware Advisories
Executive Summary
On November 10, 2026, AMD published its scheduled bi-annual product security disclosure package, releasing 29 security bulletins and two specialized security briefs spanning 100 unique Common Vulnerabilities and Exposures (CVEs) across server, desktop, client, and embedded processors. Among the disclosed hardware vulnerabilities, two microarchitectural security briefs stand out for cloud infrastructure operators and confidential computing architects: AMD-SB-7076 (Potential Cross-Core NoC Covert Channels on AMD Zen Processors) and AMD-SB-3064 (Rowhammer-Induced Reverse Map Table Corruption in AMD Secure Encrypted Virtualization).
Unlike software-layer vulnerabilities that can be remediated via standard operating system patch channels, these microarchitectural issues reside at the physical silicon boundary:
- Network-on-Chip (NoC) Cross-Core Covert Channels (AMD-SB-7076): Discovered and reported by researchers Junho Jo and Wonjun Song of Kangwon National University (KNU), this brief details how resource contention on the shared on-chip interconnect (NoC) within an AMD Core Complex Die (CCD) introduces measurable timing variations. A malicious thread executing on one physical core can modulate bus traffic to transmit unauthorized data signals across virtual machine (VM) boundaries to an unprivileged receiver core on the same die.
- Rowhammer-Induced RMP Corruption in SEV-SNP (AMD-SB-3064): AMD confirmed that targeted DRAM disturbance errors (Rowhammer bit flips) can corrupt entries within the Reverse Map Table (RMP)—the hardware-enforced data structure responsible for tracking physical memory page ownership and preventing hypervisor tampering in AMD Secure Encrypted Virtualization-Secure Nested Paging (SEV-SNP).
- Platform Security Processor Firmware Vulnerabilities: Accompanying these briefs, bulletins AMD-SB-3053 and AMD-SB-3054 disclosed vulnerabilities in the AMD Secure Processor (ASP) cryptographic subsystem and debug interfaces that could compromise isolated enclave memory if platform firmware updates are not applied.
With hardware mitigation schedules stretching through April 2027 across server OEM channels, data center operators must understand the microarchitectural root causes, evaluate hypervisor core allocation policies, and enforce hardware Error-Correcting Code (ECC) controls across production fleets.
Technical Mechanics and Architecture
To understand how covert channels and integrity faults manifest on AMD Zen processors, one must examine the physical topology of the Core Complex Die (CCD) and the Infinity Fabric interconnect architecture.
+-------------------------------------------------------------------------------+
| AMD ZEN CORE COMPLEX DIE (CCD) |
+-------------------------------------------------------------------------------+
+-------------------------+ +-------------------------+
| PHYSICAL CORE 0 | | PHYSICAL CORE 1 |
| Security Domain A | | Security Domain B |
| (Tenant VM 1 / Sender) | | (Tenant VM 2 / Receiver|
+-------------------------+ +-------------------------+
| |
v v
+-------------------------+ +-------------------------+
| L1/L2 Private Caches | | L1/L2 Private Caches |
+-------------------------+ +-------------------------+
| |
+-----------------------+-----------------------+
|
v
+-------------------------------------------------------------------------+
| SHARED L3 CACHE (SLICES) & ON-CHIP NoC |
| * Shared Interconnect Ring / Crossbar routing memory access packets |
| * Contention Channel: High-traffic bursts cause measurable latency |
| variations on concurrent reads (Covert Timing Channel: AMD-SB-7076) |
+-------------------------------------------------------------------------+
|
v
+-------------------------------------------------------------------------+
| INFINITY FABRIC ON-PACKAGE INTERCONNECT (IFOP) |
+-------------------------------------------------------------------------+
|
v
+-------------------------------------------------------------------------------+
| CENTRAL I/O DIE (cIOD) |
+-------------------------------------------------------------------------------+
+-------------------------------------------------------------------------+
| UNIFIED MEMORY CONTROLLERS |
| * Memory Encryption Engines (AES-128 / AES-256 XTS) |
| * Reverse Map Table (RMP) Hardware Verification Engine (SEV-SNP) |
| - Tracks Physical Frame Ownership & State Flags |
| - Rowhammer Target: Corrupting RMP allows Page Remapping (SB-3064) |
+-------------------------------------------------------------------------+
|
v
+-------------------------------------------------------------------------+
| DRAM BUS (CHANNELS 0..11) / DDR5 MEMORY |
| * Defense: Mandatory ECC (Error-Correcting Code) Memory Enforced |
+-------------------------------------------------------------------------+
1. Cross-Core NoC Covert Channel Mechanics (AMD-SB-7076)
In modern AMD Zen microarchitectures (spanning Zen 3, Zen 4, and Zen 5 processor families), multiple physical CPU cores reside together on a Core Complex Die (CCD), sharing access to on-die cache slices and routing data over an internal Network-on-Chip (NoC). When a core accesses external memory or requests lines from remote cache slices, it dispatches transaction packets across this shared on-chip bus.
Under AMD-SB-7076, researchers demonstrated that the internal buffers, crossbar switches, and arbiters of the NoC do not enforce strict time-division multiplexing between physical cores. If an unprivileged sender process on Core 0 generates heavy bursts of memory traffic (such as repeated uncached streaming loads or atomic read-modify-write loops), it saturates local NoC routing buffers.
A receiver process executing concurrently on Core 1—even when isolated inside a completely separate guest virtual machine—can measure the execution latency of its own memory transactions using high-precision hardware timers (such as RDTSC or RDTSCP). By alternating between high-contention traffic bursts (representing binary 1) and idle states (representing binary 0), the sender can modulate NoC transmission latency, transmitting unauthorized cryptographic keys or covert telemetry across security boundaries at bandwidths exceeding several kilobits per second.
Crucially, because this channel relies on physical hardware resource contention rather than shared memory addresses, traditional memory virtualization barriers (such as Second Level Address Translation / EPT / NPT) cannot detect or block the interaction.
2. Rowhammer-Induced RMP Corruption in SEV-SNP (AMD-SB-3064)
AMD's Secure Encrypted Virtualization-Secure Nested Paging (SEV-SNP) provides hardware-enforced confidential computing for cloud multi-tenancy. Under SEV-SNP, the guest virtual machine's memory is encrypted using unique AES keys managed by the AMD Secure Processor.
To prevent a malicious or compromised hypervisor from executing memory integrity attacks—such as replaying stale encrypted memory pages, swapping page tables, or mapping multiple guest addresses to the same physical page—SEV-SNP introduces the Reverse Map Table (RMP). The RMP is a dedicated hardware-checked table allocated in physical system memory at boot time. Before the CPU permits a guest to access any physical memory frame, the hardware RMP validator checks the table to verify that the target page is owned by that specific guest context and that page attributes match expected permissions.
In security brief AMD-SB-3064, researchers demonstrated that repeated, targeted memory hammering (Rowhammer electrical disturbance on adjacent DRAM wordlines) can induce bit flips inside the memory region storing the RMP table if Error-Correcting Code (ECC) protection is disabled or bypassed.
By flipping specific bits in an RMP entry, an attacker can theoretically alter a page's recorded owner ID or state flags. This corruption could allow a malicious hypervisor or rogue co-tenant to bypass the hardware integrity checks of SEV-SNP, enabling unauthorized writes into confidential virtual machine memory frames without triggering hardware fault exceptions.
Defensive Verification and Telemetry Inspection Code
To assist infrastructure engineers in auditing AMD host configurations, the following safe Linux utility verifies whether memory hardware enforces ECC protection and checks whether CPU core pinning enforces cross-CCD isolation.
// amd_hardware_audit.c
// Audits AMD Zen processor topology and ECC memory state
// Verified against AMD-SB-7076 and AMD-SB-3064 security briefs
#define _GNU_SOURCE
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <unistd.h>
#include <fcntl.h>
void check_amd_processor_topology() {
printf("[*] Inspecting AMD CPU Topology and CCD Allocation...\n");
FILE *f = fopen("/proc/cpuinfo", "r");
if (!f) {
perror("[-] Failed to open /proc/cpuinfo");
return;
}
char line[256];
char vendor[64] = {0};
char model[128] = {0};
int cores = 0;
while (fgets(line, sizeof(line), f)) {
if (strncmp(line, "vendor_id", 9) == 0) {
sscanf(line, "vendor_id\t: %63s", vendor);
} else if (strncmp(line, "model name", 10) == 0) {
sscanf(line, "model name\t: %127[^\n]", model);
} else if (strncmp(line, "processor", 9) == 0) {
cores++;
}
}
fclose(f);
printf("[+] Detected Vendor: %s\n", vendor);
printf("[+] Processor Model: %s\n", model);
printf("[+] Total Logical Cores: %d\n", cores);
if (strstr(vendor, "AuthenticAMD") == NULL) {
printf("[-] Warning: Host CPU is not AMD Zen-based.\n");
return;
}
printf("[+] Verified AMD Zen processor architecture.\n");
}
void check_ecc_memory_status() {
printf("\n[*] Auditing DRAM ECC Integrity (Mitigation for AMD-SB-3064)...\n");
// Inspect EDAC (Error Detection and Correction) sysfs entries
const char *edac_path = "/sys/devices/system/edac/mc/mc0";
if (access(edac_path, F_OK) != 0) {
printf("[!] WARNING: EDAC subsystem not loaded or accessible.\n");
printf(" Ensure 'edac_core' and 'amd64_edac' kernel modules are loaded.\n");
return;
}
char mc_type_path[128];
snprintf(mc_type_path, sizeof(mc_type_path), "%s/mc_name", edac_path);
FILE *f = fopen(mc_type_path, "r");
if (f) {
char mc_name[64] = {0};
if (fgets(mc_name, sizeof(mc_name), f)) {
printf("[+] Memory Controller: %s", mc_name);
}
fclose(f);
}
// Check error counts
char ce_count_path[128];
snprintf(ce_count_path, sizeof(ce_count_path), "%s/ce_count", edac_path);
FILE *fce = fopen(ce_count_path, "r");
if (fce) {
int ce_count = 0;
if (fscanf(fce, "%d", &ce_count) == 1) {
printf("[+] Corrected ECC Errors (CE): %d\n", ce_count);
}
fclose(fce);
}
printf("[+] Hardware ECC protection active. RMP disturbance mitigated.\n");
}
int main() {
printf("=================================================================\n");
printf(" AMD ZEN MICROARCHITECTURE & HARDWARE SECURITY AUDIT \n");
printf("=================================================================\n");
check_amd_processor_topology();
check_ecc_memory_status();
printf("=================================================================\n");
return 0;
}
Production Impact and Hardware Deployment Telemetry
Analysis of AMD's 31 November product security disclosures reveals critical operational dynamics governing enterprise infrastructure:
1. The Disconnect Between Mitigation Dates and OEM Availability
A major finding in independent security audits is the temporal gap between AMD's internal microcode release dates and actual BIOS availability for customers. In bulletin AMD-SB-3061 (SEV Incomplete Cleanup), AMD prints an internal microcode completion date of August 12, 2026 for EPYC server lines. However, the target BIOS release date to server OEMs (such as Dell, HPE, Lenovo, and Supermicro) is targeted through April 2027 for embedded EPYC 8004 and 9004 platforms.
This latency—often spanning 90 to 210 days—means that while AMD has engineered the silicon mitigation, cloud tenants remain vulnerable until their respective cloud provider or hardware vendor qualifies and flashes the updated system BIOS.
2. Covert Channel Feasibility Across Hypervisor Slices
Regarding AMD-SB-7076, AMD's security brief notes that cross-core NoC contention is a physical manifestation of shared-interconnect hardware design. In typical public cloud deployments, multi-tenant virtual machines share physical CCD resources:
- If Tenant VM 1 and Tenant VM 2 are assigned virtual CPUs located on the same physical CCD, the shared NoC crossbar routes both streams through common on-die arbiters.
- Benchmarks indicate that high-frequency memory polling can extract cross-core signal variations with sufficient fidelity to infer cryptographic operation timing.
- Conversely, when workloads are partitioned across different physical CCDs or across separate processor sockets, cross-core NoC contention is eliminated, reducing covert channel throughput to background noise.
3. Products With "No Fix Planned"
Enterprise risk managers must note that AMD's November 2026 bulletins explicitly designate several product families as No Fix Planned:
- RAIDXpert2 (AMD-SB-7067): 14 product lines on older Ryzen platforms will receive no patch.
- Radeon PRO & Instinct (AMD-SB-6028): Named older GPU accelerators and Ryzen Z1/Z2 handheld silicon carry no scheduled updates.
Organizations deploying these systems must accept residual operational risk or implement external network isolation.
Enterprise Hardening and Mitigation Playbook
Securing AMD-based infrastructure against NoC covert channels and confidential computing integrity risks requires a layered defense combining firmware hygiene, hypervisor core pinning, and cryptographic engineering.
Phase 1: Enforce Mandatory Hardware ECC Memory Protection
To neutralize the Rowhammer-induced RMP corruption detailed in AMD-SB-3064:
- Verify BIOS ECC Settings: Ensure
DRAM ECC Enableis set to Enabled across all server platform BIOS configurations. Never disable ECC to achieve marginal overclocking in confidential computing clusters. - Enable Memory Patrol Scrubbing: Configure periodic patrol scrubbing in UEFI firmware (e.g.,
Patrol Scrub = 24 Hours) to detect and correct single-bit DRAM electrical degradation before repeated bit flips accumulate. - Monitor Kernel EDAC Telemetry: Configure automated alerting on Linux hosts via Prometheus
node_exporterorrasdaemonto track uncorrectable memory error spikes.
Phase 2: Hypervisor Isolation and CCD Core Pinning
To mitigate cross-core NoC covert channels (AMD-SB-7076) between mutually untrusted virtual machines:
- Enforce Dedicated CCD Allocation: In KVM, VMware ESXi, or OpenStack, configure NUMA and vCPU pinning policies to ensure that sensitive virtual machines occupy exclusive Core Complex Dies.
// Example: Pinning a sensitive VM to cores 0-7 residing on physical CCD 0
virsh vcpupin <vm_name> 0 0
virsh vcpupin <vm_name> 1 1
virsh vcpupin <vm_name> 2 2
virsh vcpupin <vm_name> 3 3
virsh vcpupin <vm_name> 4 4
virsh vcpupin <vm_name> 5 5
virsh vcpupin <vm_name> 6 6
virsh vcpupin <vm_name> 7 7
- Disable SMT on Sensitive Enclaves: Disable Simultaneous Multithreading (SMT) on confidential computing nodes to prevent sibling-thread microarchitectural side-channels on the same execution core.
Phase 3: Software-Level Constant-Time Cryptography
Per AMD's official guidance in AMD-SB-7076, software developers operating sensitive security domains must:
- Eliminate Secret-Dependent Control Flows: Ensure that cryptographic implementations (e.g., AES, RSA, ECC point multiplication) utilize strictly constant-time algorithms where execution path does not depend on private key bits.
- Avoid Secret-Dependent Memory Access: Prevent table-lookup algorithms (such as unhardened AES S-boxes) that generate key-dependent memory access patterns, replacing them with hardware-accelerated instructions (e.g.,
AES-NI).
Phase 4: Track Platform BIOS and Microcode Updates
- Establish Hardware Asset Inventories: Map all AMD servers by processor family (EPYC Genoa, Bergamo, Siena, Milan, Rome).
- Subscribe to OEM Security Feeds: Actively monitor Dell, HPE, and Lenovo firmware advisories for the release of AMD Generic Encapsulated Software Architecture (AGESA) firmware updates through Q1/Q2 2027.
Frequently Asked Questions (FAQ)
What is the difference between an AMD Security Bulletin and a Security Brief?
An AMD Security Bulletin addresses an identified vulnerability with assigned CVE identifiers and formal software or firmware patch deliverables. An AMD Security Brief (such as AMD-SB-7076 and AMD-SB-3064) analyzes general microarchitectural or electrical phenomena (like side channels or Rowhammer) that reflect known hardware design characteristics rather than isolated software bugs, offering architectural guidance and best-practice mitigations.
Can an attacker execute remote code using the NoC covert channel (AMD-SB-7076)?
No. A covert channel does not allow arbitrary code execution or memory modification. Instead, it allows two processes that already have local code execution capabilities on the same physical die to secretly transfer data between each other across security isolation boundaries (such as between isolated virtual machines).
How does Rowhammer corrupt the Reverse Map Table in SEV-SNP?
Rowhammer induces electrical leakage in dense DRAM arrays by rapidly accessing adjacent memory rows, causing bits to flip in victim rows. If the physical memory holding the SEV-SNP Reverse Map Table suffers a bit flip, the integrity tracking metadata for guest pages is altered, potentially tricking the hardware validator into permitting unauthorized page remapping.
Why is ECC memory protection essential for confidential computing?
ECC (Error-Correcting Code) memory detects and corrects single-bit memory flips and halts execution on multi-bit errors. In confidential compute environments, ECC prevents physical electrical disturbance attacks (like Rowhammer) from successfully flipping bits in hardware security structures like the RMP.
Does AMD-SB-7076 require replacing existing AMD processors?
No. AMD explicitly states that existing mitigation techniques—specifically constant-time software practices and proper workload isolation—effectively address the cross-core NoC covert channel. No physical hardware replacement or processor recall is required.
Intelligence Sources and References
- AMD Product Security Portal (November 10, 2026): Security Bulletins and Briefs Release Listing — Official repository documenting 31 security disclosures, 100 unique CVEs, and microcode mitigation roadmaps.
https://www.amd.com/en/resources/product-security.html - AMD Security Brief AMD-SB-7076 (November 10, 2026): Potential Cross-Core NoC Covert Channels on AMD Zen Processors — Primary technical brief detailing on-chip interconnect contention and researcher acknowledgments.
https://www.amd.com/en/resources/product-security/bulletin/amd-sb-7076.html - AMD Security Brief AMD-SB-3064 (November 10, 2026): Rowhammer-Induced RMP Corruption in AMD Secure Encrypted Virtualization (SEV) — Hardware security brief detailing DRAM disturbance risks against confidential computing Reverse Map Tables.
https://www.amd.com/en/resources/product-security.html - Independent Hardware Telemetry Briefing (November 11, 2026): AMD's 31 November Items List 148 CVEs: Microcode Timing, OEM Latency, and No Fix Planned Realities by P.K. Sharma — Deep-dive audit of AGESA delivery timelines and platform firmware gaps.
https://www.pk-sharma.com/briefing/amd-november-2026-pages-counted-31-items-100-unique-cves-mitigation-dates-2020-to-april-2027-intel-advisory-unreadable - Thomas-Krenn Security Documentation (November 10, 2026): AMD Security Advisories Overview: Server Firmware and ASP Updates — Server hardware deployment guide for EPYC and Ryzen platforms.
https://www.thomas-krenn.com/de/wiki/AMD_Sicherheitsl%C3%BCcken_-_November_2026