CVE-2020-12965 Information disclosure in All supported processors

What is CVE-2020-12965?

CVE-2020-12965 is a high-severity vulnerability in AMD All supported processors, published on 4 Feb 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

When combined with specific software sequences, AMD CPUs may transiently execute non-canonical loads and store using only the lower 48 address bits potentially resulting in data leakage.

Weakness: CWE-74

Which versions are affected by CVE-2020-12965?

It affects 63 products.

Products include Amd Athlon 3050ge Firmware, Amd Athlon 3150g Firmware, Amd Athlon 3150ge Firmware, Amd Athlon Gold Pro 3150g Firmware, Amd Athlon Gold Pro 3150ge Firmware, Amd Athlon Pro 200ge Firmware and 57 more.

How do I fix CVE-2020-12965?

Apply the vendor's patch.

Is CVE-2020-12965 being exploited?

There is no known exploitation of CVE-2020-12965 in the wild and no public exploit code.

Other vulnerabilities in AMD All supported processors

• CVE-2021-26316 Memory corruption in 1st Gen EPYC High 7.8
• CVE-2021-26317 Security feature bypass in Athlon™ Series High 7.8
• CVE-2021-26369 Memory corruption in Athlon™ Series High 7.8
• CVE-2021-26362 Privilege escalation in Athlon™ Series High 7.1
• CVE-2021-26366 Information disclosure in Athlon™ Series High 7.1

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-wg28-p94j-5hp8.