CVE-2022-27672 Information disclosure in 1st Gen AMD EPYC™ Processors

Medium 4.7 Published 14 Feb 2023 Updated 13 Apr 2026

AMD processors may leak sensitive information via speculative execution across sibling threads when SMT is enabled.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Local or same network only
Victim action needed: Not needed
Fix: Available

What is CVE-2022-27672?

CVE-2022-27672 is a medium-severity vulnerability in Amd Epyc 7232p Firmware, published on 14 Feb 2023. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

When SMT is enabled, certain AMD processors may speculatively execute instructions using a target from the sibling thread after an SMT mode switch potentially resulting in information disclosure.

Which versions are affected by CVE-2022-27672?

It affects 165 products.

Linux distribution packages (6)

`xen` SUSE:Linux Enterprise Micro 5.3	All versions	`4.16.3_04-150400.4.22.1`
`xen` SUSE:Linux Enterprise Module for Basesystem 15 SP4	All versions	`4.16.3_04-150400.4.22.1`
`xen` SUSE:Linux Enterprise Module for Server Applications 15 SP4	All versions	`4.16.3_04-150400.4.22.1`
`xen` openSUSE:Leap 15.4	All versions	`4.16.3_04-150400.4.22.1`
`xen` openSUSE:Leap Micro 5.3	All versions	`4.16.3_04-150400.4.22.1`
`xen` openSUSE:Tumbleweed	All versions	`4.17.0_04-3.1`

Products include Amd A10-9600p Firmware, Amd A10-9630p Firmware, Amd A12-9700p Firmware, Amd A12-9730p Firmware, Amd A4-9120 Firmware, Amd A4-9120c Firmware and 159 more.

How do I fix CVE-2022-27672?

Apply the vendor's patch.

Is CVE-2022-27672 being exploited?

There is no known exploitation of CVE-2022-27672 in the wild and no public exploit code.

All Amd Epyc 7232p Firmware vulnerabilities

Sources

Also known as ALPINE-CVE-2022-27672, DEBIAN-CVE-2022-27672, GHSA-vxpc-466w-pjjv, ROOT-OS-DEBIAN-11-CVE-2022-27672, SUSE-SU-2023:0692-1, UBUNTU-CVE-2022-27672 and 1 more.