🟠 High | Source: GCP Compute Engine Security Bulletins
AMD disclosed multiple CPU vulnerabilities in November 2023 affecting EPYC server processors based on Zen 2 (Rome), Zen 3 (Milan), and Zen 4 (Genoa) architectures. Google has already patched all affected infrastructure within Google Cloud, including Compute Engine, with no evidence of active exploitation reported. Customers do not need to take any action.
Security Architect’s Take: No immediate action is required for GCP Compute Engine workloads as Google has already applied patches fleet-wide. However, architects running AMD EPYC-based workloads on-premises or in hybrid environments should verify that relevant AMD firmware and microcode updates have been applied to those assets.
Original advisory: GCP-2023-44