CVE-2023-20575

high-risk

Published 2023-07-11

A potential power side-channel vulnerability in some AMD processors may allow an authenticated attacker to use the power reporting functionality to monitor a program’s execution inside an AMD SEV VM potentially resulting in a leak of sensitive information.

Do I need to act?

0.44% chance of exploitation

EPSS score — low exploit probability

Not on CISA KEV list

No confirmed active exploitation reported to CISA

Patch status unknown

Check vendor advisories for fix availability and mitigation guidance

CVSS 6.5/10 Medium

NETWORK / LOW complexity

Affected Products (20)

Epyc 7251 Firmware

Epyc 7281 Firmware

Epyc 7301 Firmware

Epyc 7351 Firmware

Epyc 7351P Firmware

Epyc 7401 Firmware

Epyc 7401P Firmware

Epyc 7451 Firmware

Epyc 7501 Firmware

Epyc 7551 Firmware

Epyc 7551P Firmware

Epyc 7601 Firmware

Epyc Embedded 3101 Firmware

Epyc Embedded 3151 Firmware

Epyc Embedded 3201 Firmware

Epyc Embedded 3251 Firmware

Epyc Embedded 3255 Firmware

Epyc Embedded 3451 Firmware

Epyc 7232P Firmware

Epyc 7252 Firmware

Affected Vendors

Amd

References (2)

Vendor Advisory https://www.amd.com/en/corporate/product-security/bulletin/AMD-SB-3004

/ 100

high-risk

Severity 24/34 · High

Exploitability 2/34 · Minimal

Exposure 29/34 · Critical