Lucene search

Redhat.comRH:CVE-2023-20575

HistoryJul 19, 2023 - 2:37 p.m.

CVE-2023-20575

2023-07-1914:37:02

redhat.com

access.redhat.com

vulnerability

side-channel

amd processors

power reporting

authenticated attacker

sensitive information

amd sev vm

potential leak

6.5 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

0.001 Low

EPSS

Percentile

22.1%

JSON

A flaw was found in hw, where a potential power side-channel vulnerability in some AMD processors may allow an authenticated attacker to use the power reporting functionality to monitor a program’s execution inside an AMD SEV VM, potentially resulting in a leak of sensitive information.

Mitigation

Please contact AMD technical support for more updates.

References

bugzilla.redhat.com/show_bug.cgi?id=2217863

nvd.nist.gov/vuln/detail/CVE-2023-20575

www.amd.com/en/resources/product-security/bulletin/amd-sb-3004.html

www.cve.org/CVERecord?id=CVE-2023-20575

6.5 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

0.001 Low

EPSS

Percentile

22.1%

JSON

Related for RH:CVE-2023-20575