Microsoft researchers have uncovered a series of security flaws in AMD processors that could allow attackers to access confidential data, reminiscent of the infamous Spectre and Meltdown vulnerabilities.

The potential exploits were uncovered during research into a tool based on Model-based Relational Testing (MRT), in which Microsoft researchers sought to uncover cross-domain microarchitectural leaks, or flaws that let data leak between isolated CPU domains.

Their findings show that AMD’s Epyc processors, from 1st to 4th generation, contain four previously unknown vulnerabilities that could be used to access protected information.

Among the flaws found was a cross-VM leak, where an attacker could retrieve data from another virtual machine bit by bit – a significant breach of isolation in multi-tenant environments.

Another uncovered flaw lets a user-space process extract bits stored in the last ~32 kernel-mode writes, potentially exposing sensitive information from the OS kernel.

Effectively, the research showed that AMD hardware used in both desktop and data center environments could be subjected to classic side-channel attack vectors. Notably, some existing mitigations, such as cache flushing, failed to block these exploits under the new testing approach.

“The testing campaign exposed four new leaks and corroborated numerous known ones,” the researchers wrote. “These results show critical gaps in current isolation mechanisms as well as validate a robust methodology for detecting microarchitectural flaws.”

The findings ring echoes of Meltdown and Spectre, infamous bugs uncovered in 2018 by a group of Google researchers.

Those flaws were discovered in CPU architectures from the likes of AMD, Arm, and Intel, in which hardware that employed speculative execution to improve performance could have allowed attackers access to memory data, including passwords, encryption keys, and other information open in applications that are stored in memory.

Specifically, Meltdown would have allowed an attacker to read kernel memory. Spectre, meanwhile, covered a pair of flaws that could have allowed access to kernel memory available to applications running on a system.

The latest exploits were disclosed to AMD, with the chipmaking giant awarding them either “medium” or “low” severity ratings, contending that an attack would need to be highly complex to take advantage of the flaws.

AMD said it has “debugged” the identified problems and issued technical guidance for mitigating the potential flaws.

Earlier this week, a group of IBM researchers uncovered a series of security flaws in Nvidia’s GPU stack.

After reverse engineering the chipmaker’s GPU Confidential Computing (GPU-CC) feature, the researchers, alongside engineers from Ohio State University, uncovered exploits that could allow bad actors to potentially access data flowing between confidential virtual machines (VMs), and Hopper or Blackwell GPUs.