Observable discrepancy in AMD products - CVE-2022-23823

Vulnerability identifier: #VU64396

CSH Severity: Medium

CVSSv4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Green

CVE-ID: CVE-2022-23823

CWE-ID: CWE-203

Exploitation vector: Remote access

Exploit availability: No public exploit available

Vulnerable software:
AMD Athlon X4 processor
AMD Ryzen Threadripper PRO processor
2nd Gen AMD Ryzen Threadripper processors
3rd Gen AMD Ryzen Threadripper processors
7th Generation AMD A-Series APUs
AMD Ryzen 2000 Series Desktop processors
AMD Ryzen 3000 Series Desktop processors
AMD Ryzen 4000 Series Desktop processors with Radeon graphics
AMD Ryzen 2000 Series Mobile processor
AMD Athlon 3000 Series Mobile processors with Radeon Graphics
AMD Ryzen 3000 Series Mobile processors
2nd Gen AMD Ryzen Mobile processors with Radeon graphics
AMD Ryzen 4000 Series Mobile processors with Radeon graphics
AMD Ryzen 5000 Series Mobile processors with Radeon graphics
AMD Athlon Mobile processors with Radeon graphics
1st Gen AMD EPYC Processors
2nd Gen AMD EPYC Processors

Software vendor:
AMD

The vulnerability allows a remote attacker to gain access to sensitive information.

The vulnerability exists due to observable discrepancy. A remote authenticated attacker can perform  timing attack to gain access to sensitive information.

The vulnerability is dubbed Hertzbleed.

Cybersecurity Help is currently unaware of any official solution to address this vulnerability.

AMD advises developers to apply countermeasures on the software code of the cryptographic algorithm.

• https://www.amd.com/en/corporate/product-security/bulletin/amd-sb-1038