Attacker Value
Unknown
(0 users assessed)
Exploitability
Unknown
(0 users assessed)
User Interaction
None
Privileges Required
Low
Attack Vector
Local
0

CVE-2023-20588

Disclosure Date: August 08, 2023 •
CVE-2023-20588 CVSS v3 Base Score: 5.5
Add MITRE ATT&CK tactics and techniques that apply to this CVE.

Description

A division-by-zero error on some AMD processors can potentially return speculative data resulting in loss of confidentiality. 

Add Assessment

No one has assessed this topic. Be the first to add your voice to the community.

CVSS V3 Severity and Metrics
Base Score:
5.5 Medium
Impact Score:
3.6
Exploitability Score:
1.8
Vector:
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Attack Vector (AV):
Local
Attack Complexity (AC):
Low
Privileges Required (PR):
Low
User Interaction (UI):
None
Scope (S):
Unchanged
Confidentiality (C):
High
Integrity (I):
None
Availability (A):
None

General Information

Offensive Application
Unknown
Utility Class
Unknown
Ports
Unknown
OS
Unknown
Vulnerable Versions
EPYC™ 7001 Processors not down converted
Athlon™ 3000 Series Processors with Radeon™ Graphics not down converted
Ryzen™ 3000 Series Processors with Radeon™ Graphics not down converted
Athlon™ PRO 3000 Series Processors with Radeon™ Vega Graphics not down converted
Ryzen™ PRO 3000 Series Processors with Radeon™ Vega Graphics not down converted
Prerequisites
Unknown
Discovered By
Unknown
PoC Author
Unknown
Metasploit Module
Unknown
Reporter
Unknown

Vendors

  • amd,
  • debian,
  • fedoraproject,
  • microsoft,
  • xen

Products

  • athlon gold 3150g firmware -,
  • athlon gold 3150ge firmware -,
  • athlon gold pro 3150g firmware -,
  • athlon gold pro 3150ge firmware -,
  • athlon pro 300ge firmware -,
  • athlon silver 3050ge firmware -,
  • athlon silver pro 3125ge firmware -,
  • debian linux 10.0,
  • debian linux 11.0,
  • debian linux 12.0,
  • epyc 7251 firmware -,
  • epyc 7261 firmware -,
  • epyc 7281 firmware -,
  • epyc 7301 firmware -,
  • epyc 7351 firmware -,
  • epyc 7351p firmware -,
  • epyc 7371 firmware -,
  • epyc 7401 firmware -,
  • epyc 7401p firmware -,
  • epyc 7451 firmware -,
  • epyc 7501 firmware -,
  • epyc 7551 firmware -,
  • epyc 7551p firmware -,
  • epyc 7571 firmware -,
  • epyc 7601 firmware -,
  • fedora 37,
  • fedora 38,
  • fedora 39,
  • ryzen 3 3200g firmware -,
  • ryzen 3 3200ge firmware -,
  • ryzen 3 pro 3200g firmware -,
  • ryzen 3 pro 3200ge firmware -,
  • ryzen 5 3400g firmware -,
  • ryzen 5 pro 3350g firmware -,
  • ryzen 5 pro 3350ge firmware -,
  • ryzen 5 pro 3400g firmware -,
  • ryzen 5 pro 3400ge firmware -,
  • windows 10 1507,
  • windows 10 1607,
  • windows 10 1809,
  • windows 10 21h2,
  • windows 10 22h2,
  • windows 11 21h2,
  • windows 11 22h2,
  • windows 11 23h2,
  • windows server 2008 -,
  • windows server 2008 r2,
  • windows server 2012 -,
  • windows server 2012 r2,
  • windows server 2016,
  • windows server 2019,
  • windows server 2022 23h2,
  • xen -

References

Canonical
CVE-2023-20588 (https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-20588)
Miscellaneous
https://www.amd.com/en/corporate/product-security/bulletin/AMD-SB-7007
https://www.debian.org/security/2023/dsa-5480
https://www.debian.org/security/2023/dsa-5492
http://www.openwall.com/lists/oss-security/2023/09/25/3
http://www.openwall.com/lists/oss-security/2023/09/25/4
http://xenbits.xen.org/xsa/advisory-439.html
http://www.openwall.com/lists/oss-security/2023/09/25/5
http://www.openwall.com/lists/oss-security/2023/09/25/8
http://www.openwall.com/lists/oss-security/2023/09/25/7
http://www.openwall.com/lists/oss-security/2023/09/26/5
http://www.openwall.com/lists/oss-security/2023/09/26/8
http://www.openwall.com/lists/oss-security/2023/09/26/9
http://www.openwall.com/lists/oss-security/2023/09/27/1
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KJTUVYZMP6BNF342DS3W7XGOGXC6JPN5/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/AGZCACEHT6ZZZGG36QQMGROBM4FLWYJX/
http://www.openwall.com/lists/oss-security/2023/10/03/14
http://www.openwall.com/lists/oss-security/2023/10/03/9
http://www.openwall.com/lists/oss-security/2023/10/03/15
http://www.openwall.com/lists/oss-security/2023/10/03/12
http://www.openwall.com/lists/oss-security/2023/10/03/13
http://www.openwall.com/lists/oss-security/2023/10/03/16
http://www.openwall.com/lists/oss-security/2023/10/04/1
http://www.openwall.com/lists/oss-security/2023/10/04/2
http://www.openwall.com/lists/oss-security/2023/10/04/4
http://www.openwall.com/lists/oss-security/2023/10/04/3
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/DIOYP4ZOBML4RCUM3MHRFZUQL445MZM3/
https://lists.debian.org/debian-lts-announce/2023/10/msg00027.html
https://security.netapp.com/advisory/ntap-20240531-0005/

Additional Info

Authenticated
Unknown
Exploitable
Unknown
Reliability
Unknown
Stability
Unknown
Available Mitigations
Unknown
Shelf Life
Unknown
Userbase/Installbase
Unknown
Patch Effectiveness
Unknown
Technical Analysis