CVE-2022-29900 Other in AMD Processors

Medium 6.5 Published 12 Jul 2022 Updated 20 Nov 2024

Mis-trained branch predictions in AMD processors allow arbitrary speculative code execution, potentially exposing sensitive data or enabling code injection.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Local or same network only
Victim action needed: Not needed
Fix: Available

What is CVE-2022-29900?

CVE-2022-29900 is a medium-severity vulnerability in Amd Epyc 7252 Firmware, published on 12 Jul 2022. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

Mis-trained branch predictions for return instructions may allow arbitrary speculative code execution under certain microarchitecture-dependent conditions.

Weakness: CWE-212

Which versions are affected by CVE-2022-29900?

It affects 126 products.

Products include Amd A10-9600p Firmware, Amd A10-9630p Firmware, Amd A12-9700p Firmware, Amd A12-9730p Firmware, Amd A4-9120 Firmware, Amd A6-9210 Firmware and 120 more.

How do I fix CVE-2022-29900?

Apply the vendor's patch.

Is CVE-2022-29900 being exploited?

There is no known exploitation of CVE-2022-29900 in the wild and no public exploit code.

Public exploit code: 1 proofs of concept on GitHub.

All Amd Epyc 7252 Firmware vulnerabilities

Sources

Also known as ALPINE-CVE-2022-29900, DEBIAN-CVE-2022-29900, GHSA-f3p5-98fc-2gxr, UBUNTU-CVE-2022-29900.