Information disclosure in AMD products - CVE-2020-12966
Published: July 12, 2022
Vulnerability identifier: #VU65122
CSH Severity: Low
CVSS v4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2020-12966
CWE-ID: CWE-200
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a local user to gain access to potentially sensitive information.
The vulnerability exists due to a Ciphertext side channel attack on ECC and DH operations in the Secure Encrypted Virtualization with Encrypted State (SEV-ES)
and Secure Encrypted Virtualization with Secure Nested Paging (SEV-SNP). A local user with control over hypervisor can obtain sensitive data from the guest OS.
Affected software
1st Gen AMD EPYC Processors
2nd Gen AMD EPYC Processors
3rd Gen AMD EPYC Processors
AMD EPYC Embedded Processors
wolfSSL
Dell EMC VxRail Appliance
2nd Gen AMD EPYC Processors
3rd Gen AMD EPYC Processors
AMD EPYC Embedded Processors
wolfSSL
Dell EMC VxRail Appliance
How to mitigate CVE-2020-12966
Install updates from vendor's website.
wolfSSL - update to 5.4.0
Dell EMC VxRail Appliance - update to 7.0.350
Dell EMC VxRail Appliance - update to 7.0.350