Improper Initialization in 3rd Gen AMD EPYC Processors and 4th Gen AMD EPYC Processors - CVE-2023-31346

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU94741

Improper Initialization in 3rd Gen AMD EPYC Processors and 4th Gen AMD EPYC Processors - CVE-2023-31346

Published: July 25, 2024


Vulnerability identifier: #VU94741
CSH Severity: Low
CVSS v4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2023-31346
CWE-ID: CWE-665
Exploitation vector: Local access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a local user to gain access to sensitive information.

The vulnerability exists due to improper initialization in SEV Firmware. A local user can run a specially crafted application to access stale data from other guests.


Affected software

3rd Gen AMD EPYC Processors
4th Gen AMD EPYC Processors
IBM Qradar SIEM
Anolis OS
Red Hat Enterprise Linux Server - AUS
Red Hat Enterprise Linux Server - TUS
Red Hat Enterprise Linux for ARM 64 - Extended Update Support
Red Hat Enterprise Linux for Power, little endian - Extended Update Support
Red Hat Enterprise Linux for IBM z Systems - Extended Update Support
Red Hat Enterprise Linux for x86_64 - Extended Update Support
Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions
iwl5150-firmware
iwl5000-firmware
iwl6000-firmware
iwl3945-firmware
iwl6000g2b-firmware
iwl6000g2a-firmware
iwl105-firmware
iwl135-firmware
iwl2000-firmware
iwl2030-firmware
iwl7260-firmware
iwl3160-firmware
iwl1000-firmware
iwl100-firmware
iwl6050-firmware
iwl4965-firmware
linux-firmware (Red Hat package)
libertas-sd8686-firmware
libertas-sd8787-firmware
libertas-usb8388-firmware
libertas-usb8388-olpc-firmware
linux-firmware
PowerFlex Appliance
Technical Support Appliance
IBM QRadar Incident Forensics
Red Hat OpenShift Container Platform
IBM QRadar Network Packet Capture
IBM Power Hardware Management Console (HMC)

How to mitigate CVE-2023-31346

Install updates from vendor's website.

IBM Qradar SIEM - update to 7.5.0 Update Pack 10
PowerFlex Appliance - update to IC-46.380.01
Technical Support Appliance - update to 3.0.1
Red Hat OpenShift Container Platform - update to 4.12.61
IBM QRadar Network Packet Capture - update to 7.5.0 Update Package 10
IBM QRadar Incident Forensics - update to 7.5.0.10
iwl5150-firmware - update to 8.24.2.2-122
iwl5000-firmware - update to 8.83.5.1_1-122
iwl6000-firmware - update to 9.221.4.1-122
IBM Power Hardware Management Console (HMC) - addressed in versions 10.2.1040.0 SP3, 10.3.1060.0 SP1
iwl3945-firmware - update to 15.32.2.9-122
iwl6000g2b-firmware - update to 18.168.6.1-122
iwl6000g2a-firmware - update to 18.168.6.1-122
iwl105-firmware - update to 18.168.6.1-122
iwl135-firmware - update to 18.168.6.1-122
iwl2000-firmware - update to 18.168.6.1-122
iwl2030-firmware - update to 18.168.6.1-122
iwl7260-firmware - update to 25.30.13.0-122
iwl3160-firmware - update to 25.30.13.0-122
iwl1000-firmware - update to 39.31.5.1-122
iwl100-firmware - update to 39.31.5.1-122
iwl6050-firmware - update to 41.28.5.1-122
iwl4965-firmware - update to 228.61.2.24-122
linux-firmware (Red Hat package) - addressed in versions 20240610-106.1.git90df68d2.el8_4, 20240610-114.1.git90df68d2.el8_6, 20240610-118.1.git90df68d2.el8_8, 20240715-102.2.git4c8fb21e.el8_2
libertas-sd8686-firmware - update to 20240610-122.git90df68d2
libertas-sd8787-firmware - update to 20240610-122.git90df68d2
libertas-usb8388-firmware - update to 20240610-122.git90df68d2
libertas-usb8388-olpc-firmware - update to 20240610-122.git90df68d2
linux-firmware - update to 20240610-122.git90df68d2

External References

Related Security Bulletins