Google Cloud Warns of Three AMD Turin CPU Side-Channel Flaws That Could Leak Data Across Processes in VMs
Google Cloud has issued a security bulletin detailing three Transient Scheduler Attack (TSA) vulnerabilities in fifth-generation AMD EPYC processors, codenamed Turin. The flaws, identified as CVE-2024-36350, CVE-2024-36357, and CVE-2026-0004, affect multiple machine series including C4D, N4D, H4D, Z4D, and G4. While mitigations between VMs and the host have already been applied, intra-VM attacks remain possible without guest OS patches. Customers must install vendor fixes, wait for updated CPU information in VMs, and perform a stop-and-start operation rather than a simple reboot. The issues also impact bare-metal instances and certain hypervisors running inside VMs. AMD and the Xen Project have released related advisories and microcode updates.
The Hacker NewsNov 12, 2026Translated from English