CVE-2023-20588 Speculative Leaks
A division-by-zero error in AMD processors allows speculative execution to leak confidential data, requiring firmware updates.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2023-20588?
CVE-2023-20588 is a medium-severity vulnerability in Debian Debian Linux, published on 8 Aug 2023. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
A division-by-zero error on some AMD processors can potentially return speculative data resulting in loss of confidentiality.
Weakness: CWE-369
Which versions are affected by CVE-2023-20588?
It affects 47 products.
Products include Amd Athlon Gold 3150g Firmware, Amd Athlon Gold 3150ge Firmware, Amd Athlon Gold Pro 3150g Firmware, Amd Athlon Gold Pro 3150ge Firmware, Amd Athlon Pro 300ge Firmware, Amd Athlon Silver 3050ge Firmware and 41 more.
How do I fix CVE-2023-20588?
Apply the vendor's patch.
Is CVE-2023-20588 being exploited?
There is no known exploitation of CVE-2023-20588 in the wild and no public exploit code.
Other vulnerabilities in Debian Debian Linux
- CVE-2021-46753 Memory corruption in Athlon™ 3000 Series Mobile Processors with Radeon™ Graphics “Pollock”
- CVE-2021-46754 Information disclosure in AMD Ryzen™ Embedded R1000
- CVE-2022-23815 Memory corruption in AMD Athlon™ 3000 Series Desktop Processors with Radeon™ Graphics
- CVE-2021-46749 Denial of service in 3rd Gen AMD Ryzen™ Threadripper™ Processors “Castle Peak” HEDT
- CVE-2021-46794 Denial of service in 3rd Gen AMD Ryzen™ Threadripper™ Processors “Castle Peak” HEDT
Sources
Also known as ALPINE-CVE-2023-20588, DEBIAN-CVE-2023-20588, GHSA-6h77-2hc9-qm3w, UBUNTU-CVE-2023-20588.