CVE-2023-20592: Improper or unexpected behavior of the INVD instruction in some AMD CPUs may allow an attacker with a malicious hypervisor to affect cache l

Affected versions

NVD version ranges (for catalog products). Add the product to your stack with a version and matching uses these.

• amd epyc 7001 firmwareall versions
• amd epyc 7203 firmwarebefore milanpi_1.0.0.c
• amd epyc 7203p firmwarebefore milanpi_1.0.0.c
• amd epyc 7232p firmwareall versions
• amd epyc 7251 firmwareall versions
• amd epyc 7252 firmwareall versions
• amd epyc 7261 firmwareall versions
• amd epyc 7262 firmwareall versions
• amd epyc 7272 firmwareall versions
• amd epyc 7281 firmwareall versions
• amd epyc 7282 firmwareall versions
• amd epyc 72f3 firmwarebefore milanpi_1.0.0.c
• amd epyc 7301 firmwareall versions
• amd epyc 7302 firmwareall versions
• amd epyc 7302p firmwareall versions
• amd epyc 7303 firmwarebefore milanpi_1.0.0.c
• amd epyc 7303p firmwarebefore milanpi_1.0.0.c
• amd epyc 7313 firmwarebefore milanpi_1.0.0.c
• amd epyc 7313p firmwarebefore milanpi_1.0.0.c
• amd epyc 7343 firmwarebefore milanpi_1.0.0.c

Versions reported by the vendor

Affected version ranges reported by the assigning authority (AMD). Independent of NVD's CPE analysis and usually ahead of it.

• AMD 1st Gen AMD EPYC™ Processors

  • variousaffected

• AMD 2nd Gen AMD EPYC™ Processors

  • variousaffected

• AMD 3rd Gen AMD EPYC™ Processors

  • variousaffected

Package-level exposure

OSV and GitHub Advisory data: ecosystem, package and range. SBOM matching uses this table.

Other highest-scoring records for the same primary product.

• CVE-2021-26340A malicious hypervisor in conjunction with an unprivileged attacker process inside an SEV/SEV-ES guest VM may fail to flush the Translation
  33Monitor
• CVE-2021-46774Insufficient DRAM address validation in System Management Unit (SMU) may allow an attacker to read/write from/to an invalid DRAM address, po
  30Monitor
• CVE-2020-12988A potential denial of service (DoS) vulnerability exists in the integrated chipset that may allow a malicious attacker to hang the system wh
  30Monitor

Published before and after this one in the same product

• ← EarlierCVE-2021-26356May 9, 2023 · A TOCTOU in ASP bootloader may allow an attacker to tamper with the SPI ROM following data read to memory potentially resulting in S3 data c
  29Monitor
• ← EarlierCVE-2023-20521Nov 14, 2023 · TOCTOU in the ASP Bootloader may allow an attacker with physical access to tamper with SPI ROM records after memory content verification, po
  22Monitor
• ← EarlierCVE-2023-20526Nov 14, 2023 · Insufficient input validation in the ASP Bootloader may enable a privileged attacker with physical access to expose the contents of ASP memo
  18Monitor

Attack context

MITRE CAPEC attack patterns and ATT&CK techniques for this weakness class (CWE). A starting point for detection rules and threat hunting.

MITRE has no CAPEC/ATT&CK mapping for this CWE.