Improper Address Validation in AMD Products with SNP Enabled
CVE-2023-20566

5.3MEDIUM

Key Information:

Vendor

Amd
Status
3rd Gen Amd Epyc™ Processors
4th Gen Amd Epyc™ Processors
Amd Epyc™ Embedded 7003
Amd Epyc™ Embedded 9003
Vendor
CVE Published:
14 November 2023

What is CVE-2023-20566?

A vulnerability exists in AMD's ASP when Secure Nested Paging (SNP) is enabled, which may allow an attacker to compromise guest memory integrity by exploiting improper address validation. This flaw could potentially lead to unauthorized access and manipulation of sensitive data within guest systems.

Affected Version(s)

3rd Gen AMD EPYC™ Processors x86 various

4th Gen AMD EPYC™ Processors x86 various

AMD EPYC™ Embedded 7003 various

References

https://www.amd.com/en/corporate/product-security/bulleti...
vendor-advisory

CVSS V3.1

Score:
5.3
Severity:
MEDIUM
Confidentiality:
None
Integrity:
High
Availability:
None
Attack Vector:
Local
Attack Complexity:
High
Privileges Required:
High
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.