Ruiyi Zhang

Microarchitectural Security | PhD Candidate at CISPA | Ex Research Intern @Google | #StackWarp #CacheWarp

[Ruiyi Zhang @Rayiizzz]

Today we reveal StackWarp: a new CPU vulnerability exploiting a synchronization bug in AMD’s stack engine across Zen 1–5 CPUs. It enables deterministic manipulation of Confidential VM's stack pointer, allowing RCE and privilege escalation via both control- and data-flow hijacking

[Daniel Weber @weber_daniel]

After an embargo of 256 days, I'm happy to reveal our newest work: we present TREVEX, a black-box CPU fuzzer that detects transient execution vulnerabilities in an automated manner. Running TREVEX on AMD, Intel, and Zhaoxin CPUs discovered multiple new CPU vulnerabilities!

[HOSEIN YAVARZADEH @hosein_yz]

Private AI in Confidential VMs isn't as private as we thought. 🤯

We just showed how to reconstruct user LLM prompts word-for-word from inside an encrypted Intel TDX enclave—without breaking any cryptography.

Introducing TDXRay (IEEE S&P 2026): https://t.co/rZIcJG76pI

(1/4)

[Ruiyi Zhang @Rayiizzz]

@CPUGenius11 yes, a microcode update

[Ruiyi Zhang @Rayiizzz]

Today we reveal StackWarp: a new CPU vulnerability exploiting a synchronization bug in AMD’s stack engine across Zen 1–5 CPUs. It enables deterministic manipulation of Confidential VM's stack pointer, allowing RCE and privilege escalation via both control- and data-flow hijacking

[Ruiyi Zhang @Rayiizzz]

@robertomasymas @weber_daniel @fth0mas @misc0110 I’m leaning toward it being an implementation bug. Regardless, it’s patched now, and CVMs are more secure.

[Ruiyi Zhang @Rayiizzz]

@JustWantToQ1 That's correct. As I noted in the quote, while the bug exists on Zen 1-5, it only becomes a security vulnerability for confidential VMs.

[Ruiyi Zhang @Rayiizzz]

If an SMT sibling disables it, the RSP delta becomes 'frozen' and is only released to a future execution context when the bit is toggled again.
While the underlying bug exists across Zen 1-5, it only poses a security risk in specific scenarios, like within confidential computing.

[Ruiyi Zhang @Rayiizzz]

To clear up some confusion: the root cause lies in the stack engine, a CPU frontend optimization that manages the Stack Pointer (RSP) to reduce backend overhead.

We discovered that an undocumented MSR bit acts as a toggle for this optimization. (1/2)

[Ruiyi Zhang @Rayiizzz]

Today we reveal StackWarp: a new CPU vulnerability exploiting a synchronization bug in AMD’s stack engine across Zen 1–5 CPUs. It enables deterministic manipulation of Confidential VM's stack pointer, allowing RCE and privilege escalation via both control- and data-flow hijacking

[SecurityWeek @SecurityWeek]

New StackWarp Attack Threatens Confidential VMs on AMD Processors https://t.co/xGxCpeVcN5

[Ruiyi Zhang @Rayiizzz]

@offby1security Sounds awesome, would love to!

[Ruiyi Zhang @Rayiizzz]

@Void_The_Null We disclosed this vulnerability to AMD in March 2025 and embargo is over as of today. AMD already released a microcode patch to mitigate it :)

[Ruiyi Zhang @Rayiizzz]

Blogpost: https://t.co/249QfTR8EQ

[Ruiyi Zhang @Rayiizzz]

For more details on the discovery process and our findings, we refer to our research paper, which is published at USENIX Security 2026.

paper: https://t.co/Z8ozxKUqIv
github: https://t.co/9guHTl8lDu

\cc Tristan Hornetz, @weber_daniel, @fth0mas, @misc0110

[Kav @kavehrazavi]

The program for uASC'26 is online https://t.co/HKLjyiNEkl We have some very interesting papers which are already available, so be sure to check them out. Better yet, join us in Leuven next month to listen to the authors! Registration is still open and free but seats are limited.

[Shweta Shinde @shw3ta_shinde]

🔓 Heracles @acm_ccs'25: Breaking AMD’s Confidential Computing!
We show that the hypervisor can read and move hardware-encrypted memory on AMD SEV-SNP.
We build a chosen-plaintext oracle to leak kernel memory, auth keys, and cookies from "confidential" VMs
https://t.co/upHXpLqSeA

[Ruiyi Zhang @Rayiizzz]

@lyq_sqsp Congrats!

[Kav @kavehrazavi]

I am chairing the second edition of the microarchitecture security conference (uASC'26). Paper deadline for the first cycle is July 15. Please spread the word, submit, and/or join us in charming Leuven in February 2026! More info: https://t.co/nAIs7HZ1SS

[Kav @kavehrazavi]

long embargo, but there is a demo with good music at least: https://t.co/7Gla8DCMla

[Seres István András @Istvan_A_Seres]

✅ Write constant-time crypto code
☠️ Compiler introduces timing side-channels

Do Compilers Break Constant-time Guarantees?
https://t.co/x0f0GCmcjC

TL;DR: Yes!🥲

👏👏👏Great work @misc0110 & team!

[Matteo Rizzo @_MatteoRizzo]

https://t.co/JE68XbHamM
Our newest research project is finally public! We can load malicious microcode on Zen1-Zen4 CPUs!