CVE-2023-20597 Information disclosure in AMD EPYC™ Embedded 7003

Medium 5.5 Published 20 Sep 2023 Updated 27 Jun 2025

A privileged local attacker can leak sensitive information due to improper variable initialization in AMD DXE drivers.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Local or same network only
Victim action needed: Not needed
Fix: None listed

What is CVE-2023-20597?

CVE-2023-20597 is a medium-severity vulnerability in AMD EPYC™ Embedded 7003, published on 20 Sep 2023. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

Improper initialization of variables in the DXE driver may allow a privileged user to leak sensitive information via local access.

Weakness: CWE-665, CWE-824

Which versions are affected by CVE-2023-20597?

It affects 101 products.

Products include Amd Ryzen 3100 Firmware, Amd Ryzen 3300x Firmware, Amd Ryzen 3500 Firmware, Amd Ryzen 3500x Firmware, Amd Ryzen 3600 Firmware, Amd Ryzen 3600x Firmware and 95 more.

How do I fix CVE-2023-20597?

No fix has been published for CVE-2023-20597 yet. Limit exposure of the affected software until one is available.

Is CVE-2023-20597 being exploited?

There is no known exploitation of CVE-2023-20597 in the wild and no public exploit code.

Sources

Also known as GHSA-8prm-gh76-rq38.