CVE-2023-20593

2023-07-2400:00:00

ubuntu.com

zen 2

cpus

microarchitectural

attack

sensitive information

cve-2023-20593

ubuntu

linux firmware

amd microcode

patch

amd updates

amd64-microcode

kernel

vulnerability

CVSS3

5.5

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

EPSS

0.001

Percentile

35.1%

JSON

An issue in “Zen 2” CPUs, under specific microarchitectural circumstances,
may allow an attacker to potentially access sensitive information.

Notes

Author	Note
	Priority reason: Allows a local attacker to read the contents of arbitrary processes, even across VM boundaries - PoC is publicly available.
alexmurray	In Ubuntu the linux-firmware source package does not ship the AMD microcode - instead this is contained within the amd64-microcode source package. There is also an associated patch for the Linux kernel to add a new chicken-bit which will automatically be set to enable a fallback workaround in the kernel in the case that the associated microcode is not available. Finally, the updates released by AMD on 2023-07-24 only cover Rome / Castle Peak and Mendocino designs - updates for consumer oriented designs like Matisse, Renoir etc are expected later in the year. This is not planned to be fixed for the amd64-microcode package in Ubuntu 14.04 as that release was already outside of the LTS timeframe when this hardware platform was launched.

Author

Note

Priority reason: Allows a local attacker to read the contents of arbitrary processes, even across VM boundaries - PoC is publicly available.

alexmurray

In Ubuntu the linux-firmware source package does not ship the AMD microcode - instead this is contained within the amd64-microcode source package. There is also an associated patch for the Linux kernel to add a new chicken-bit which will automatically be set to enable a fallback workaround in the kernel in the case that the associated microcode is not available. Finally, the updates released by AMD on 2023-07-24 only cover Rome / Castle Peak and Mendocino designs - updates for consumer oriented designs like Matisse, Renoir etc are expected later in the year. This is not planned to be fixed for the amd64-microcode package in Ubuntu 14.04 as that release was already outside of the LTS timeframe when this hardware platform was launched.

OSVersionArchitecturePackageVersionFilename
ubuntu18.04noarchamd64-microcode< 3.20191021.1+really3.20181128.1~ubuntu0.18.04.1+esm1UNKNOWN
ubuntu20.04noarchamd64-microcode< 3.20191218.1ubuntu1.1UNKNOWN
ubuntu22.04noarchamd64-microcode< 3.20191218.1ubuntu2.1UNKNOWN
ubuntu23.04noarchamd64-microcode< 3.20220411.1ubuntu3.1UNKNOWN
ubuntu23.10noarchamd64-microcode< 3.20230719.1ubuntu1UNKNOWN
ubuntu24.04noarchamd64-microcode< 3.20230719.1ubuntu1UNKNOWN
ubuntu16.04noarchamd64-microcode< 3.20191021.1+really3.20180524.1~ubuntu0.16.04.2+esm1UNKNOWN
ubuntu18.04noarchlinux< 4.15.0-216.227UNKNOWN
ubuntu20.04noarchlinux< 5.4.0-159.176UNKNOWN
ubuntu22.04noarchlinux< 5.15.0-82.91UNKNOWN

OS	Version	Architecture	Package	Version	Filename
ubuntu	18.04	noarch	amd64-microcode	< 3.20191021.1+really3.20181128.1~ubuntu0.18.04.1+esm1	UNKNOWN
ubuntu	20.04	noarch	amd64-microcode	< 3.20191218.1ubuntu1.1	UNKNOWN
ubuntu	22.04	noarch	amd64-microcode	< 3.20191218.1ubuntu2.1	UNKNOWN
ubuntu	23.04	noarch	amd64-microcode	< 3.20220411.1ubuntu3.1	UNKNOWN
ubuntu	23.10	noarch	amd64-microcode	< 3.20230719.1ubuntu1	UNKNOWN
ubuntu	24.04	noarch	amd64-microcode	< 3.20230719.1ubuntu1	UNKNOWN
ubuntu	16.04	noarch	amd64-microcode	< 3.20191021.1+really3.20180524.1~ubuntu0.16.04.2+esm1	UNKNOWN
ubuntu	18.04	noarch	linux	< 4.15.0-216.227	UNKNOWN
ubuntu	20.04	noarch	linux	< 5.4.0-159.176	UNKNOWN
ubuntu	22.04	noarch	linux	< 5.15.0-82.91	UNKNOWN