#VU65204 Type Confusion in AMD products - CVE-2022-23825

Vulnerability identifier: #VU65204

Vulnerability risk: Low

CVSSv4.0: CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear

CVE-ID: CVE-2022-23825

CWE-ID: CWE-843

Exploitation vector: Local access

Exploit availability: No public exploit available

Vulnerable software:
AMD Athlon X4 processor
AMD Ryzen Threadripper PRO processor
2nd Gen AMD Ryzen Threadripper processors
3rd Gen AMD Ryzen Threadripper processors
7th Generation AMD A-Series APUs
AMD Ryzen 2000 series Desktop processor
AMD Ryzen 3000 Series Desktop processor
AMD Ryzen 4000 Series Desktop processors with Radeon graphics
AMD Ryzen 2000 Series Mobile processor
AMD Athlon 3000 Series Mobile processors with Radeon Graphics
AMD Ryzen 3000 Series Mobile processor
2nd Gen AMD Ryzen Mobile processor with Radeon graphics
AMD Ryzen 4000 Series Mobile processors with Radeon graphics
AMD Ryzen 5000 Series Mobile processor with Radeon graphics
AMD Athlon Mobile processor with Radeon graphics
1st Gen AMD EPYC Processors
2nd Gen AMD EPYC Processors

Software vendor:
AMD

The vulnerability allows a local user to gain access to sensitive information.

The vulnerability exists due to a branch type confusion. A local user can force the branch predictor to predict the wrong branch type and gain access to sensitive information.

Install updates from vendor's website.

• https://www.amd.com/en/corporate/product-security/bulletin/amd-sb-1037