AMD has disclosed a critical vulnerability affecting its Zen 5 processor series, which compromises the reliability of random number generation, a fundamental security feature in modern computing.
See also: AMD and OpenAI challenge Nvidia's dominance in AI chips
The vulnerability, tracked as CVE-2025-62626, affects the RDSEED used by systems to generate cryptographically secure random numbers, necessary for encryption, authentication, and other security functions.
The issue arises from a flaw in the implementation of the RDSEED instruction in Zen 5 processors. Under certain conditions, the instruction returns a value of zero while incorrectly signaling success via the carry flag (CF=1).
This behavior creates a dangerous scenario where the software believes it has received a valid random number when in fact it has received a predictable value of zero. The issue affects both the 16-bit and 32-bit forms of the RDSEED command, although the 64-bit version remains unaffected.
AMD learned of this bug through an unusual channel. The issue was first reported publicly on the Linux kernel mailing list rather than through AMD's standard Coordinated Vulnerability Disclosure process. This public disclosure path highlights the collaborative nature of open source security research, but also highlights the challenge of managing security information through disparate reporting channels.
The severity of this vulnerability cannot be underestimated. Random number generation is the backbone of cryptographic security in modern systems.
See also: Battering RAM Attack Bypasses Intel and AMD Security
When RDSEED silently fails by returning zeros while indicating success, applications may generate weak encryption keys, predictable authentication tokens, or compromised security protocols.
An attacker with access to the local system could potentially exploit this weakness to predict or influence cryptographic operations, leading to data breaches or unauthorized access.
System administrators can use the 64-bit form of RDSEED exclusively, hide the RDSEED feature from software detection by modifying boot parameters, or implement software logic to treat null returns as failures requiring retries. The company plans to release microcode updates and AGESA firmware across its portfolio.
AMD EPYC 9005 Series processors will receive updates until mid-November 2025, while the consumer Ryzen 9000 Series, Ryzen AI 300 Series , and Threadripper 9000 processors are targeted for late November releases. Embedded processor variants will see updates rolled out until January 2026.
See also: How to update AMD drivers for better performance?
Organizations operating affected Zen 5 systems should prioritize applying these updates as soon as they are available through their original equipment manufacturers. Until updates are deployed, implementing the recommended software workarounds provides essential protection against potential exploitation of this randomness vulnerability.
🔒 Protect your privacy with Proton VPN
Swiss VPN from the creators of Proton Mail — strict no-logs policy, strong encryption, and built-in NetShield that blocks ads, trackers, & malware.
- ✔ No-logs, based in Switzerland (except 14-Eyes)
- ✔ NetShield: blocks ads, trackers & malicious domains
- ✔ Covers all devices — free version available
The link is an affiliate link — SecNews may receive a commission at no additional cost to you. It does not affect the independence of our article writing.
