Observable discrepancy in AMD products - CVE-2022-23823

Vulnerability identifier: #VU64396

CSH Severity: Medium

CVSS v4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2022-23823

CWE-ID: CWE-203

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to gain access to sensitive information.

The vulnerability exists due to observable discrepancy. A remote authenticated attacker can perform  timing attack to gain access to sensitive information.

The vulnerability is dubbed Hertzbleed.

AMD Ryzen 2000 Series Mobile processor
2nd Gen AMD EPYC Processors
1st Gen AMD EPYC Processors
AMD Athlon Mobile processors with Radeon graphics
AMD Ryzen 5000 Series Mobile processors with Radeon graphics
AMD Ryzen 4000 Series Mobile processors with Radeon graphics
2nd Gen AMD Ryzen Mobile processors with Radeon graphics
AMD Ryzen 3000 Series Mobile processors
AMD Athlon 3000 Series Mobile processors with Radeon Graphics
AMD Athlon X4 processor
AMD Ryzen 4000 Series Desktop processors with Radeon graphics
AMD Ryzen 3000 Series Desktop processors
AMD Ryzen 2000 Series Desktop processors
7th Generation AMD A-Series APUs
3rd Gen AMD Ryzen Threadripper processors
2nd Gen AMD Ryzen Threadripper processors
AMD Ryzen Threadripper PRO processor
BIG-IP
F5OS
BIG-IQ Centralized Management

Cybersecurity Help is currently unaware of any official solution to address this vulnerability.

AMD advises developers to apply countermeasures on the software code of the cryptographic algorithm.

• https://www.amd.com/en/corporate/product-security/bulletin/amd-sb-1038

• Information disclosure in multiple AMD processors
• Hertzbleed vulnerability in F5 BIG-IP on AMD processors
• Hertzbleed vulnerability in F5 BIG-IQ Centralized Management on AMD processors
• Hertzbleed vulnerability in F5 F5OS on AMD processors