CVE-2023-20585 Memory corruption in AMD EPYC™ 7003 Series Processors
A compromised hypervisor can trigger out-of-bounds memory access in AMD EPYC IOMMU, compromising confidential guest integrity.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2023-20585?
CVE-2023-20585 is a medium-severity memory corruption vulnerability in AMD EPYC™ 7003 Series Processors, published on 16 Apr 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
Insufficient checks of the RMP on host buffer access in IOMMU may allow an attacker with privileges and a compromised hypervisor to trigger an out of bounds condition without RMP checks, resulting in a potential loss of confidential guest integrity.
Weakness: CWE-788
Which versions are affected by CVE-2023-20585?
How do I fix CVE-2023-20585?
Apply the vendor's patch.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2023-20585 being exploited?
There is no known exploitation of CVE-2023-20585 in the wild and no public exploit code.
Sources
Also known as GHSA-c43c-pr38-m5g2, ROOT-OS-UBUNTU-2404-CVE-2023-20585, UBUNTU-CVE-2023-20585.