Ethical Hacking News
Google Cloud has issued a critical security alert regarding three CPU side-channel flaws in the AMD Turin CPU architecture, which could potentially leak data across processes in VMs. The company advises customers to take immediate action to protect their systems and data, and has provided guidance on mitigating the vulnerabilities.
Google Cloud has issued a critical security alert due to three CPU side-channel flaws (Transient Scheduler Attacks) in AMD Turin CPU architecture. The affected machine series include C4D, N4D, H4D, Z4D, and G4, as well as bare-metal instances of C4D and Z4D. The vulnerabilities, first disclosed on July 8, 2025, impact Zen 5 processors, including Turin. Google has rated the issue as Medium and advises customers to take immediate action to protect their VMs and bare metal instances. Customers should install OS vendor's fix, stop and start VMs, and apply hypervisor patches to mitigate the vulnerabilities. The vulnerability may affect performance, and administrators should weigh the risk to their own workloads before taking any action.
Google Cloud has issued a critical security alert regarding the AMD Turin CPU architecture, which is used in various Google Cloud VMs, bare metal instances, and hypervisors. According to the company, three CPU side-channel flaws, identified as Transient Scheduler Attacks (TSA), could potentially leak data across processes in VMs. The affected machine series include C4D, N4D, H4D, Z4D, and G4, as well as bare-metal instances of C4D and Z4D.
The vulnerabilities, which were first disclosed on July 8, 2025, for earlier EPYC processors, have been found to impact the Zen 5 processors, which include Turin. The third flaw, CVE-2026-0004, is a new vulnerability that may allow an attacker to infer data in the processor's L1 data cache. This could potentially be exploited by an attacker with code on the same processor core, allowing them to infer data from other processes or the kernel.
Google has rated the issue as Medium and advises customers to take immediate action to protect their VMs and bare metal instances. The company recommends installing the OS vendor's fix when it becomes available, as well as stopping and starting the VMs to activate mitigations. For hypervisors inside a VM, the same CPU information update applies, and customers should stop and start the VM once the update arrives.
Additionally, Google has updated the node images for Turin-based bare metal instances and will make them available for upgrading nodes. However, the company advises customers not to take any action for Cloud Run, as no exploitation has been reported in this service.
The Xen Project has also published hypervisor patches to address the vulnerabilities, stating that microcode for all TSA flaws on Zen 5 has been included in the Linux kernel source tree since September 23. AMD has classified all three flaws as local attacks with high attack complexity that require only low privileges, and has published its technical guidance for mitigating the vulnerabilities fully.
It is worth noting that the vulnerability may affect performance, and administrators should weigh the risk to their own workloads before taking any action. The company advises customers to take immediate action to protect their VMs and bare metal instances, as well as to stay informed about the latest security updates and patches.
The discovery of this critical vulnerability highlights the importance of ongoing security monitoring and patching, particularly in cloud-based environments where the risk of exploitation can be high. As the threat landscape continues to evolve, it is essential for organizations to stay vigilant and take proactive steps to protect their systems and data.
Related Information:
https://www.ethicalhackingnews.com/articles/Google-Cloud-Warns-of-Critical-Vulnerability-in-AMD-Turin-CPU-Architecture-Affecting-Multi-Process-Data-Privacy-ehn.shtml
https://thehackernews.com/2026/11/google-cloud-warns-three-amd-turin-cpu.html
Published: Thu Nov 12 08:13:28 2026 by llama3.2 3B Q4_K_M
