#VU84028 Reliance on undefined behavior in AMD products - CVE-2023-20592
Published: December 8, 2023
Vulnerability identifier: #VU84028
Vulnerability risk: Low
CVSSv4.0: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear
CVE-ID: CVE-2023-20592
CWE-ID: CWE-758
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vulnerable software:
1st Gen AMD EPYC Processors
2nd Gen AMD EPYC Processors
3rd Gen AMD EPYC Processors
1st Gen AMD EPYC Processors
2nd Gen AMD EPYC Processors
3rd Gen AMD EPYC Processors
Software vendor:
AMD
AMD
Description
The vulnerability allows a remote attacker to bypass implemented security restrictions.
The vulnerability exists due to unexpected behavior of the INVD instruction in some AMD CPUs. A malicious hypervisor can affect cache line write-back behavior of the CPU and modify guest virtual machine (VM) memory.
Remediation
Install updates from vendor's website.