Information disclosure in AMD CPU Firmware - CVE-2020-12965

Vulnerability identifier: #VU57349

CSH Severity: Low

CVSS v4: 6.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2020-12965

CWE-ID: CWE-200

Exploitation vector: Local access

Exploit availability: No public exploit available

The vulnerability allows a local attacker to gain access to potentially sensitive information.

The vulnerability exists due to CPUs transiently execute non-canonical loads using only the lower 48 address bits. A local attacker can gain unauthorized access to sensitive information on the system.

AMD CPU Firmware
openEuler
python3-perf-debuginfo
kernel
bpftool
bpftool-debuginfo
kernel-debuginfo
kernel-debugsource
kernel-devel
kernel-headers
kernel-source
kernel-tools
kernel-tools-debuginfo
kernel-tools-devel
perf
perf-debuginfo
python3-perf
kernel-extra-modules

Cybersecurity Help is currently unaware of any official solution to address this vulnerability.

python3-perf-debuginfo - addressed in versions 6.6.0-139.0.0.120, 6.6.0-139.0.0.133
kernel - addressed in versions 6.6.0-139.0.0.120, 6.6.0-139.0.0.133
bpftool - addressed in versions 6.6.0-139.0.0.120, 6.6.0-139.0.0.133
bpftool-debuginfo - addressed in versions 6.6.0-139.0.0.120, 6.6.0-139.0.0.133
kernel-debuginfo - addressed in versions 6.6.0-139.0.0.120, 6.6.0-139.0.0.133
kernel-debugsource - addressed in versions 6.6.0-139.0.0.120, 6.6.0-139.0.0.133
kernel-devel - addressed in versions 6.6.0-139.0.0.120, 6.6.0-139.0.0.133
kernel-headers - addressed in versions 6.6.0-139.0.0.120, 6.6.0-139.0.0.133
kernel-source - addressed in versions 6.6.0-139.0.0.120, 6.6.0-139.0.0.133
kernel-tools - addressed in versions 6.6.0-139.0.0.120, 6.6.0-139.0.0.133
kernel-tools-debuginfo - addressed in versions 6.6.0-139.0.0.120, 6.6.0-139.0.0.133
kernel-tools-devel - addressed in versions 6.6.0-139.0.0.120, 6.6.0-139.0.0.133
perf - addressed in versions 6.6.0-139.0.0.120, 6.6.0-139.0.0.133
perf-debuginfo - addressed in versions 6.6.0-139.0.0.120, 6.6.0-139.0.0.133
python3-perf - addressed in versions 6.6.0-139.0.0.120, 6.6.0-139.0.0.133
kernel-extra-modules - update to 6.6.0-139.0.0.133

• https://www.amd.com/en/corporate/product-security/bulletin/amd-sb-1010
• https://www.amd.com/system/files/documents/security-whitepaper.pdf
• https://developer.amd.com/wp-content/resources/90343-D_SoftwareTechniquesforManagingSpeculation_WP_9-20Update_R2.pdf

• Multiple vulnerabilities in AMD CPUs
• openEuler 24.03 LTS SP2 update for kernel
• openEuler 24.03 LTS SP1 update for kernel
• openEuler 24.03 LTS update for kernel