CyberSecBulletin
CVE-2023-20591NVD status: Modified

AMD EPYC™ 7003 Series Processors: Improper Initialization

Published Updated By the CyberSecBulletin desk

CVE-2023-20591 is a critical-severity improper initialization vulnerability in AMD EPYC™ 7003 Series Processors from AMD, with a CVSS 3.1 base score of 10.0 out of 10. It can be exploited remotely over the network by an unauthenticated attacker, without any action from a user. There is no confirmed exploitation so far. EPSS estimates a 0.3% chance of exploitation within 30 days, which is low compared with other CVEs.

Patch this week

Critical severity: a successful attack would have severe impact.

What to do

  1. Update epyc_7003_firmware to milanpi_1.0.0.b or a later version.
  2. Update epyc_9003_firmware to genoapi_1.0.0.8 or a later version.
  3. Update epyc_7773x_firmware to milanpi_1.0.0.b or a later version.
  4. Read the advisory on amd.com for workarounds and exact fixed builds.
  5. Until you can update, restrict network access to the affected service so it is not reachable from untrusted networks.

Affected products and versions

VendorProductAffected versionsFixed in
AMDAMD EPYC™ 7003 Series ProcessorsNot specified in the recordNot stated
AMDAMD EPYC™ 9004 Series ProcessorsNot specified in the recordNot stated
AMDAMD EPYC™ Embedded 7003 Series ProcessorsNot specified in the recordNot stated
AMDAMD EPYC™ Embedded 9003 Series ProcessorsNot specified in the recordNot stated
AMDepyc_7003_firmwarebefore milanpi_1.0.0.bmilanpi_1.0.0.b
AMDepyc_9003_firmwarebefore genoapi_1.0.0.8genoapi_1.0.0.8
AMDepyc_7773x_firmwarebefore milanpi_1.0.0.bmilanpi_1.0.0.b
AMDepyc_9754s_firmwarebefore genoapi_1.0.0.8genoapi_1.0.0.8
AMDEpyc 8024pn Firmwarebefore genoapi_1.0.0.8genoapi_1.0.0.8
AMDEpyc 8024p Firmwarebefore genoapi_1.0.0.8genoapi_1.0.0.8
AMDEpyc 8124pn Firmwarebefore genoapi_1.0.0.8genoapi_1.0.0.8
AMDEpyc 8124p Firmwarebefore genoapi_1.0.0.8genoapi_1.0.0.8
AMDEpyc 8224pn Firmwarebefore genoapi_1.0.0.8genoapi_1.0.0.8
AMDEpyc 8224p Firmwarebefore genoapi_1.0.0.8genoapi_1.0.0.8
AMDEpyc 8324pn Firmwarebefore genoapi_1.0.0.8genoapi_1.0.0.8
AMDEpyc 8324p Firmwarebefore genoapi_1.0.0.8genoapi_1.0.0.8
AMDEpyc 8434pn Firmwarebefore genoapi_1.0.0.8genoapi_1.0.0.8
AMDEpyc 8434p Firmwarebefore genoapi_1.0.0.8genoapi_1.0.0.8
AMDEpyc 8534pn Firmwarebefore genoapi_1.0.0.8genoapi_1.0.0.8
AMDEpyc 8534p Firmwarebefore genoapi_1.0.0.8genoapi_1.0.0.8
AMDEpyc 9734 Firmwarebefore genoapi_1.0.0.8genoapi_1.0.0.8
AMDEpyc 9754 Firmwarebefore genoapi_1.0.0.8genoapi_1.0.0.8
AMDEpyc 9184x Firmwarebefore genoapi_1.0.0.8genoapi_1.0.0.8
AMDEpyc 9384x Firmwarebefore genoapi_1.0.0.8genoapi_1.0.0.8
AMDEpyc 9684x Firmwarebefore genoapi_1.0.0.8genoapi_1.0.0.8

Version data comes from the organisation that assigned the CVE; 35 further products are omitted here. Confirm against the vendor advisory before deciding you are unaffected.

How the severity score breaks down

Attack vector
NetworkCan be exploited remotely over a network, including the internet.
Attack complexity
LowNo special conditions are needed; the attack works reliably.
Privileges required
NoneNo account or login is needed.
User interaction
NoneNo action by a victim is required.
Scope
ChangedThe attack can reach beyond the vulnerable component into other systems.
Confidentiality
HighAll data handled by the component can be read.
Integrity
HighData or code can be modified at will.
Availability
HighThe component can be taken down completely.

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H. Scored by NVD.

Scoring systemScoreSeverityScored by
CVSS 3.16.5MediumCNA (amd.com)
CVSS 3.110.0CriticalNVD

Official description

Improper re-initialization of IOMMU during the DRTM event may permit an untrusted platform configuration to persist, allowing an attacker to read or modify hypervisor memory, potentially resulting in loss of confidentiality, integrity, and availability.

Source: the CVE record as published by its numbering authority, via NVD and CVE.org.

The underlying weakness: Improper Initialization

The product does not initialize or incorrectly initializes a resource.

How developers prevent this class of flaw

  • Use a language that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid. For example, in Java, if the programmer does not explicitly initialize a variable, then the code could produce a compile-time error (if the variable is local) or automatically initialize the variable to the default value for the variable's type. In Perl, if explicit initialization is not performed, then a default value of undef is assigned, which is interpreted as 0, false, or an equivalent value depending on the context in which the variable is accessed.
  • Identify all variables and data stores that receive information from external sources, and apply input validation to make sure that they are only initialized to expected values.
  • Explicitly initialize all your variables and other data stores, either during declaration or just before the first usage.

More Improper Initialization vulnerabilities (CWE-665)

Timeline

  1. CVE record published.
  2. CISA published its SSVC assessment (exploitation: none, automatable: yes, technical impact: partial).
  3. Record last changed materially (score, affected products, status or references).

References

Other vulnerabilities in AMD EPYC™ 7003 Series Processors

All AMD EPYC™ 7003 Series Processors vulnerabilities

Recent Improper Initialization vulnerabilities

Spotted an error? Tell us.