Strix
26.1K

CVE-2023-20592

MEDIUMCVSS 6.5/10EPSS 1.02%

Last modified

CVE-2023-20592 is a medium-severity vulnerability rated 6.5/10 on the CVSS scale. Improper or unexpected behavior of the INVD instruction in some AMD CPUs may allow an attacker with a malicious hypervisor to affect cache line write-back behavior of the CPU leading to a potential loss of guest virtual machine (VM) memory integrity. . EPSS estimates a 1.02% chance of exploitation in the next 30 days.

Description

Improper or unexpected behavior of the INVD instruction in some AMD CPUs may allow an attacker with a malicious hypervisor to affect cache line write-back behavior of the CPU leading to a potential loss of guest virtual machine (VM) memory integrity.

Metrics

CVSS 3.1
6.5/10

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

EPSS Probability
1.02%

58.9th percentile

Probability of exploitation in the next 30 days. Learn more

Affected Software

VendorProductVersions
AmdEpyc 7001 FirmwareAll versions
AmdEpyc 7251 FirmwareAll versions
AmdEpyc 7261 FirmwareAll versions
AmdEpyc 7281 FirmwareAll versions
AmdEpyc 7301 FirmwareAll versions
AmdEpyc 7351 FirmwareAll versions
AmdEpyc 7351p FirmwareAll versions
AmdEpyc 7371 FirmwareAll versions
AmdEpyc 7401 FirmwareAll versions
AmdEpyc 7401p FirmwareAll versions
AmdEpyc 7451 FirmwareAll versions
AmdEpyc 7501 FirmwareAll versions
AmdEpyc 7551 FirmwareAll versions
AmdEpyc 7551p FirmwareAll versions
AmdEpyc 7601 FirmwareAll versions
AmdEpyc 7232p FirmwareAll versions
AmdEpyc 7252 FirmwareAll versions
AmdEpyc 7262 FirmwareAll versions
AmdEpyc 7272 FirmwareAll versions
AmdEpyc 7282 FirmwareAll versions
AmdEpyc 7302 FirmwareAll versions
AmdEpyc 7302p FirmwareAll versions
AmdEpyc 7352 FirmwareAll versions
AmdEpyc 7402 FirmwareAll versions
AmdEpyc 7402p FirmwareAll versions
AmdEpyc 7452 FirmwareAll versions
AmdEpyc 7502 FirmwareAll versions
AmdEpyc 7502p FirmwareAll versions
AmdEpyc 7532 FirmwareAll versions
AmdEpyc 7542 FirmwareAll versions
AmdEpyc 7552 FirmwareAll versions
AmdEpyc 7642 FirmwareAll versions
AmdEpyc 7662 FirmwareAll versions
AmdEpyc 7702 FirmwareAll versions
AmdEpyc 7702p FirmwareAll versions
AmdEpyc 7742 FirmwareAll versions
AmdEpyc 7f32 FirmwareAll versions
AmdEpyc 7f52 FirmwareAll versions
AmdEpyc 7f72 FirmwareAll versions
AmdEpyc 7h12 FirmwareAll versions
AmdEpyc 7763 Firmware< milanpi_1.0.0.c
AmdEpyc 7713p Firmware< milanpi_1.0.0.c
AmdEpyc 7713 Firmware< milanpi_1.0.0.c
AmdEpyc 7663p Firmware< milanpi_1.0.0.c
AmdEpyc 7663 Firmware< milanpi_1.0.0.c
AmdEpyc 7643p Firmware< milanpi_1.0.0.c
AmdEpyc 7773x Firmware< milanpi_1.0.0.c
AmdEpyc 7643 Firmware< milanpi_1.0.0.c
AmdEpyc 7573x Firmware< milanpi_1.0.0.c
AmdEpyc 75f3 Firmware< milanpi_1.0.0.c

Showing 50 of 69 affected configurations. See NVD for the full list.

References

Timeline

Published
Last Modified
Status
Modified

Frequently Asked Questions

What is CVE-2023-20592?
Improper or unexpected behavior of the INVD instruction in some AMD CPUs may allow an attacker with a malicious hypervisor to affect cache line write-back behavior of the CPU leading to a potential loss of guest virtual machine (VM) memory integrity.
How severe is CVE-2023-20592?
CVE-2023-20592 has a CVSS score of 6.5/10 (MEDIUM severity). The EPSS model estimates a 1.02% probability of exploitation in the next 30 days.
How do I fix CVE-2023-20592?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

Are you affected by CVE-2023-20592?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST