Vulnerability Details : CVE-2023-20593
Potential exploit
An issue in “Zen 2” CPUs, under specific microarchitectural circumstances, may allow an attacker to potentially access sensitive information.
Products affected by CVE-2023-20593
- cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*
- cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*
- cpe:2.3:o:debian:debian_linux:12.0:*:*:*:*:*:*:*
- cpe:2.3:o:xen:xen:4.15.0:*:*:*:*:*:x86:*
- cpe:2.3:o:xen:xen:4.17.0:*:*:*:*:*:x86:*
- cpe:2.3:o:xen:xen:4.14.0:*:*:*:*:*:x86:*
- cpe:2.3:o:xen:xen:4.16.0:*:*:*:*:*:x86:*
- cpe:2.3:o:amd:epyc_7f72_firmware:-:*:*:*:*:*:*:*
- cpe:2.3:o:amd:epyc_7f52_firmware:-:*:*:*:*:*:*:*
- cpe:2.3:o:amd:epyc_7f32_firmware:-:*:*:*:*:*:*:*
- cpe:2.3:o:amd:epyc_7h12_firmware:-:*:*:*:*:*:*:*
- cpe:2.3:o:amd:epyc_7742_firmware:-:*:*:*:*:*:*:*
- cpe:2.3:o:amd:epyc_7702_firmware:-:*:*:*:*:*:*:*
- cpe:2.3:o:amd:epyc_7702p_firmware:-:*:*:*:*:*:*:*
- cpe:2.3:o:amd:epyc_7662_firmware:-:*:*:*:*:*:*:*
- cpe:2.3:o:amd:epyc_7642_firmware:-:*:*:*:*:*:*:*
- cpe:2.3:o:amd:epyc_7552_firmware:-:*:*:*:*:*:*:*
- cpe:2.3:o:amd:epyc_7542_firmware:-:*:*:*:*:*:*:*
- cpe:2.3:o:amd:epyc_7532_firmware:-:*:*:*:*:*:*:*
- cpe:2.3:o:amd:epyc_7502_firmware:-:*:*:*:*:*:*:*
- cpe:2.3:o:amd:epyc_7502p_firmware:-:*:*:*:*:*:*:*
- cpe:2.3:o:amd:epyc_7452_firmware:-:*:*:*:*:*:*:*
- cpe:2.3:o:amd:epyc_7402_firmware:-:*:*:*:*:*:*:*
- cpe:2.3:o:amd:epyc_7402p_firmware:-:*:*:*:*:*:*:*
- cpe:2.3:o:amd:epyc_7352_firmware:-:*:*:*:*:*:*:*
- cpe:2.3:o:amd:epyc_7302_firmware:-:*:*:*:*:*:*:*
- cpe:2.3:o:amd:epyc_7302p_firmware:-:*:*:*:*:*:*:*
- cpe:2.3:o:amd:epyc_7282_firmware:-:*:*:*:*:*:*:*
- cpe:2.3:o:amd:epyc_7272_firmware:-:*:*:*:*:*:*:*
- cpe:2.3:o:amd:epyc_7262_firmware:-:*:*:*:*:*:*:*
- cpe:2.3:o:amd:epyc_7252_firmware:-:*:*:*:*:*:*:*
- cpe:2.3:o:amd:epyc_7232p_firmware:-:*:*:*:*:*:*:*
- cpe:2.3:o:amd:ryzen_threadripper_pro_3995wx_firmware:-:*:*:*:*:*:*:*
- cpe:2.3:o:amd:ryzen_threadripper_pro_3975wx_firmware:-:*:*:*:*:*:*:*
- cpe:2.3:o:amd:ryzen_threadripper_pro_3955wx_firmware:-:*:*:*:*:*:*:*
- cpe:2.3:o:amd:ryzen_threadripper_pro_3945wx_firmware:-:*:*:*:*:*:*:*
- cpe:2.3:o:amd:ryzen_threadripper_3990x_firmware:-:*:*:*:*:*:*:*
- cpe:2.3:o:amd:ryzen_threadripper_3970x_firmware:-:*:*:*:*:*:*:*
- cpe:2.3:o:amd:ryzen_threadripper_3960x_firmware:-:*:*:*:*:*:*:*
- cpe:2.3:o:amd:ryzen_9_3950x_firmware:-:*:*:*:*:*:*:*
- cpe:2.3:o:amd:ryzen_9_3900x_firmware:-:*:*:*:*:*:*:*
- cpe:2.3:o:amd:ryzen_7_3800x_firmware:-:*:*:*:*:*:*:*
- cpe:2.3:o:amd:ryzen_7_3700x_firmware:-:*:*:*:*:*:*:*
- cpe:2.3:o:amd:ryzen_5_3600x_firmware:-:*:*:*:*:*:*:*
- cpe:2.3:o:amd:ryzen_5_3600_firmware:-:*:*:*:*:*:*:*
- cpe:2.3:o:amd:ryzen_3_3300x_firmware:-:*:*:*:*:*:*:*
- cpe:2.3:o:amd:ryzen_3_3100_firmware:-:*:*:*:*:*:*:*
- cpe:2.3:o:amd:ryzen_7_4700g_firmware:-:*:*:*:*:*:*:*
- cpe:2.3:o:amd:ryzen_7_4700ge_firmware:-:*:*:*:*:*:*:*
- cpe:2.3:o:amd:ryzen_5_4600g_firmware:-:*:*:*:*:*:*:*
- cpe:2.3:o:amd:ryzen_5_4600ge_firmware:-:*:*:*:*:*:*:*
- cpe:2.3:o:amd:ryzen_3_4300g_firmware:-:*:*:*:*:*:*:*
- cpe:2.3:o:amd:ryzen_3_4300ge_firmware:-:*:*:*:*:*:*:*
- cpe:2.3:o:amd:ryzen_3_5300u_firmware:-:*:*:*:*:*:*:*
- cpe:2.3:o:amd:ryzen_5_5500u_firmware:-:*:*:*:*:*:*:*
- cpe:2.3:o:amd:ryzen_7_5700u_firmware:-:*:*:*:*:*:*:*
- cpe:2.3:o:amd:ryzen_5_3600xt_firmware:-:*:*:*:*:*:*:*
- cpe:2.3:o:amd:ryzen_7_3800xt_firmware:-:*:*:*:*:*:*:*
- cpe:2.3:o:amd:ryzen_5_3500_firmware:-:*:*:*:*:*:*:*
- cpe:2.3:o:amd:ryzen_5_3500x_firmware:-:*:*:*:*:*:*:*
- cpe:2.3:o:amd:ryzen_9_3900_firmware:-:*:*:*:*:*:*:*
- cpe:2.3:o:amd:ryzen_9_3900xt_firmware:-:*:*:*:*:*:*:*
- cpe:2.3:o:amd:ryzen_9_pro_3900_firmware:-:*:*:*:*:*:*:*
- cpe:2.3:o:amd:athlon_gold_7220u_firmware:-:*:*:*:*:*:*:*
- cpe:2.3:o:amd:ryzen_3_pro_4450u_firmware:-:*:*:*:*:*:*:*
- cpe:2.3:o:amd:ryzen_3_pro_4350ge_firmware:-:*:*:*:*:*:*:*
- cpe:2.3:o:amd:ryzen_3_pro_4350g_firmware:-:*:*:*:*:*:*:*
- cpe:2.3:o:amd:ryzen_3_pro_4200g_firmware:-:*:*:*:*:*:*:*
- cpe:2.3:o:amd:ryzen_5_pro_4650ge_firmware:-:*:*:*:*:*:*:*
- cpe:2.3:o:amd:ryzen_5_pro_4650g_firmware:-:*:*:*:*:*:*:*
- cpe:2.3:o:amd:ryzen_5_pro_4400g_firmware:-:*:*:*:*:*:*:*
- cpe:2.3:o:amd:ryzen_7_pro_4750u_firmware:-:*:*:*:*:*:*:*
- cpe:2.3:o:amd:ryzen_7_pro_4750ge_firmware:-:*:*:*:*:*:*:*
- cpe:2.3:o:amd:ryzen_7_pro_4750g_firmware:-:*:*:*:*:*:*:*
- cpe:2.3:o:amd:ryzen_5_7520u_firmware:-:*:*:*:*:*:*:*
- cpe:2.3:o:amd:ryzen_3_7320u_firmware:-:*:*:*:*:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2023-20593
6.48%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 91 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2023-20593
Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
---|---|---|---|---|---|---|
5.5
|
MEDIUM | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N |
1.8
|
3.6
|
NIST |
CWE ids for CVE-2023-20593
-
The product generates an error message that includes sensitive information about its environment, users, or associated data.Assigned by: 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary)
References for CVE-2023-20593
-
http://www.openwall.com/lists/oss-security/2023/07/25/14
oss-security - Re: CVE-2023-20593: A use-after-free in AMD Zen2 ProcessorsMailing List
-
http://www.openwall.com/lists/oss-security/2023/07/25/13
oss-security - Re: CVE-2023-20593: A use-after-free in AMD Zen2 ProcessorsMailing List
-
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HKKYIK2EASDNUV4I7EFJKNBVO3KCKGRR/
[SECURITY] Fedora 37 Update: xen-4.16.5-1.fc37 - package-announce - Fedora Mailing-Lists
-
http://www.openwall.com/lists/oss-security/2023/08/16/5
oss-security - Re: Xen Security Advisory 433 v3 (CVE-2023-20593) - x86/AMD: Zenbleed
-
http://xenbits.xen.org/xsa/advisory-433.html
XSA-433 - Xen Security AdvisoriesMitigation;Patch;Vendor Advisory
-
http://www.openwall.com/lists/oss-security/2023/07/25/12
oss-security - Re: CVE-2023-20593: A use-after-free in AMD Zen2 ProcessorsMailing List
-
http://www.openwall.com/lists/oss-security/2023/07/25/5
oss-security - Re: CVE-2023-20593: A use-after-free in AMD Zen2 ProcessorsMailing List
-
http://www.openwall.com/lists/oss-security/2023/09/22/9
oss-security - Re: illumos (or at least danmcd) membership in the distros list
-
http://www.openwall.com/lists/oss-security/2023/07/25/1
oss-security - Re: CVE-2023-20593: A use-after-free in AMD Zen2 ProcessorsMailing List
-
http://www.openwall.com/lists/oss-security/2023/09/25/4
oss-security - Re: Xen Security Advisory 439 v1 (CVE-2023-20588) - x86/AMD: Divide speculative information leak
-
http://seclists.org/fulldisclosure/2023/Jul/43
SecLists.Org Security Mailing List ArchiveNot Applicable
-
http://www.openwall.com/lists/oss-security/2023/09/25/7
oss-security - Re: Xen Security Advisory 439 v1 (CVE-2023-20588) - x86/AMD: Divide speculative information leak
-
http://www.openwall.com/lists/oss-security/2023/08/16/4
oss-security - Re: Xen Security Advisory 433 v3 (CVE-2023-20593) - x86/AMD: Zenbleed
-
http://www.openwall.com/lists/oss-security/2023/07/25/6
oss-security - Re: CVE-2023-20593: A use-after-free in AMD Zen2 ProcessorsMailing List
-
https://lists.debian.org/debian-lts-announce/2023/07/msg00030.html
[SECURITY] [DLA 3508-1] linux security updateMailing List
-
https://cmpxchg8b.com/zenbleed.html
ZenbleedExploit
-
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CP6WQO3CDPLE5O635N7TAL5KCZ6HZ4FE/
[SECURITY] Fedora 38 Update: spectre-meltdown-checker-0.46-1.fc38 - package-announce - Fedora Mailing-Lists
-
https://www.debian.org/security/2023/dsa-5462
Debian -- Security Information -- DSA-5462-1 linuxThird Party Advisory
-
http://www.openwall.com/lists/oss-security/2023/07/31/2
oss-security - Xen Security Advisory 433 v3 (CVE-2023-20593) - x86/AMD: ZenbleedMailing List;Mitigation;Patch;Third Party Advisory
-
http://www.openwall.com/lists/oss-security/2023/08/08/8
oss-security - Re: Xen Security Advisory 433 v3 (CVE-2023-20593) - x86/AMD: Zenbleed
-
https://lists.debian.org/debian-lts-announce/2023/07/msg00033.html
[SECURITY] [DLA 3511-1] amd64-microcode security updateMailing List;Third Party Advisory
-
http://www.openwall.com/lists/oss-security/2023/09/22/11
oss-security - Re: illumos (or at least danmcd) membership in the distros list
-
http://www.openwall.com/lists/oss-security/2023/07/25/16
oss-security - Re: CVE-2023-20593: A use-after-free in AMD Zen2 ProcessorsMailing List
-
http://www.openwall.com/lists/oss-security/2023/07/25/17
oss-security - Re: CVE-2023-20593: A use-after-free in AMD Zen2 ProcessorsMailing List
-
https://www.debian.org/security/2023/dsa-5461
Debian -- Security Information -- DSA-5461-1 linuxThird Party Advisory
-
https://www.debian.org/security/2023/dsa-5459
Debian -- Security Information -- DSA-5459-1 amd64-microcodeThird Party Advisory
-
https://www.amd.com/en/corporate/product-security/bulletin/AMD-SB-7008
Access DeniedVendor Advisory
-
http://www.openwall.com/lists/oss-security/2023/07/25/15
oss-security - Re: CVE-2023-20593: A use-after-free in AMD Zen2 ProcessorsMailing List
-
https://lists.debian.org/debian-lts-announce/2023/08/msg00001.html
[SECURITY] [DLA 3512-1] linux-5.10 security update
-
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SD2G74BXS2SWOE3FIQJ6X76S3A7PDGML/
[SECURITY] Fedora 38 Update: xen-4.17.1-9.fc38 - package-announce - Fedora Mailing-Lists
-
http://www.openwall.com/lists/oss-security/2023/07/24/3
oss-security - Re: CVE-2023-20593: A use-after-free in AMD Zen2 ProcessorsMailing List
-
http://www.openwall.com/lists/oss-security/2023/08/08/7
oss-security - Re: Xen Security Advisory 433 v3 (CVE-2023-20593) - x86/AMD: Zenbleed
-
http://www.openwall.com/lists/oss-security/2023/07/26/1
oss-security - Xen Security Advisory 433 v2 (CVE-2023-20593) - x86/AMD: ZenbleedMailing List;Mitigation;Patch;Third Party Advisory
-
http://www.openwall.com/lists/oss-security/2023/08/08/6
oss-security - Re: Xen Security Advisory 433 v3 (CVE-2023-20593) - x86/AMD: Zenbleed
-
https://security.netapp.com/advisory/ntap-20240531-0004/
CVE-2023-20593 Debian Vulnerability in NetApp Products | NetApp Product Security
Jump to