#VU65205 Processor optimization removal or modification of security-critical code in AMD products - CVE-2022-29900

Vulnerability identifier: #VU65205

Vulnerability risk: Low

CVSSv4.0: CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

CVE-ID: CVE-2022-29900

CWE-ID: CWE-1037

Exploitation vector: Local access

Exploit availability: No public exploit available

Vulnerable software:
AMD Athlon X4 processor
AMD Ryzen Threadripper PRO processor
2nd Gen AMD Ryzen Threadripper processors
3rd Gen AMD Ryzen Threadripper processors
7th Generation AMD A-Series APUs
AMD Ryzen 2000 series Desktop processor
AMD Ryzen 3000 Series Desktop processor
AMD Ryzen 4000 Series Desktop processors with Radeon graphics
AMD Ryzen 2000 Series Mobile processor
AMD Athlon 3000 Series Mobile processors with Radeon Graphics
AMD Ryzen 3000 Series Mobile processor
2nd Gen AMD Ryzen Mobile processor with Radeon graphics
AMD Ryzen 4000 Series Mobile processors with Radeon graphics
AMD Ryzen 5000 Series Mobile processor with Radeon graphics
AMD Athlon Mobile processor with Radeon graphics
1st Gen AMD EPYC Processors
2nd Gen AMD EPYC Processors

Software vendor:
AMD

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a mistrained branch predictions for return instructions. A local user can execute arbitrary speculative code under certain microarchitecture-dependent conditions. The vulnerability was dubbed  RETbleed.

Install updates from vendor's website.

• https://www.amd.com/en/corporate/product-security/bulletin/amd-sb-1037