#VU65122 Information disclosure in AMD products - CVE-2020-12966
Published: July 12, 2022
Vulnerability identifier: #VU65122
Vulnerability risk: Low
CVSSv4.0: CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear
CVE-ID: CVE-2020-12966
CWE-ID: CWE-200
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vulnerable software:
1st Gen AMD EPYC Processors
2nd Gen AMD EPYC Processors
3rd Gen AMD EPYC Processors
AMD EPYC Embedded Processors
1st Gen AMD EPYC Processors
2nd Gen AMD EPYC Processors
3rd Gen AMD EPYC Processors
AMD EPYC Embedded Processors
Software vendor:
AMD
AMD
Description
The vulnerability allows a local user to gain access to potentially sensitive information.
The vulnerability exists due to a Ciphertext side channel attack on ECC and DH operations in the Secure Encrypted Virtualization with Encrypted State (SEV-ES)
and Secure Encrypted Virtualization with Secure Nested Paging (SEV-SNP). A local user with control over hypervisor can obtain sensitive data from the guest OS.
Remediation
Install updates from vendor's website.