CVE-2023-20583 - Vulnerability Details - OpenCVE

A potential power side-channel vulnerability in AMD processors may allow an authenticated attacker to monitor the CPU power consumption as the data in a cache line changes over time potentially resulting in a leak of sensitive information.

No CVSS v4.0

Attack Vector Local

Attack Complexity High

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact None

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable no

Technical Impact partial

Vendors	Products
Amd	*

Configuration 1 [-]

cpe:2.3:h:amd:*:*:*:*:*:*:*:*:*

No data.

References

Link	Providers
https://nvd.nist.gov/vuln/detail/CVE-2023-20583
https://www.amd.com/en/corporate/product-security/bulletin/AMD-SB-7006
https://www.amd.com/en/resources/product-security/bulletin/amd-sb
https://www.amd.com/en/resources/product-security/bulletin/amd-sb-7006.html
https://www.cve.org/CVERecord?id=CVE-2023-20583

History

Thu, 17 Oct 2024 21:15:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

MITRE

Status: PUBLISHED

Assigner: AMD

Published: 2023-08-01T18:00:43.783Z

Updated: 2024-10-17T20:12:58.969Z

Reserved: 2022-10-27T18:53:39.758Z

Link: CVE-2023-20583

Vulnrichment

Updated: 2024-08-02T09:05:36.980Z

NVD

Status : Modified

Published: 2023-08-01T19:15:09.827

Modified: 2024-11-21T07:41:10.017

Link: CVE-2023-20583

Redhat

Severity : Low

Publid Date: 2023-08-01T00:00:00Z

Links: CVE-2023-20583 - Bugzilla

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2023-20583", "assignerOrgId": "b58fc414-a1e4-4f92-9d70-1add41838648", "state": "PUBLISHED", "assignerShortName": "AMD", "dateReserved": "2022-10-27T18:53:39.758Z", "datePublished": "2023-08-01T18:00:43.783Z", "dateUpdated": "2024-10-17T20:12:58.969Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "platforms": ["x86"], "product": "Processors", "vendor": "AMD", "versions": [{"status": "affected", "version": "Various "}]}], "datePublic": "2023-08-01T19:30:00.000Z", "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<span style=\"background-color: rgb(248, 249, 250);\">A potential power side-channel vulnerability in\nAMD processors may allow an authenticated attacker to monitor the CPU power\nconsumption as the data in a cache line changes over time potentially resulting\nin a leak of sensitive information.\n\n\n\n</span>\n\n\n\n\n\n\n\n\n\n"}], "value": "A potential power side-channel vulnerability in\nAMD processors may allow an authenticated attacker to monitor the CPU power\nconsumption as the data in a cache line changes over time potentially resulting\nin a leak of sensitive information.\n\n\n\n\n\n\n\n\n\n\n\n\n\n"}], "providerMetadata": {"orgId": "b58fc414-a1e4-4f92-9d70-1add41838648", "shortName": "AMD", "dateUpdated": "2023-08-01T18:00:43.783Z"}, "references": [{"tags": ["vendor-advisory"], "url": "https://www.amd.com/en/corporate/product-security/bulletin/AMD-SB-7006"}], "source": {"advisory": "AMD-SB-7006", "discovery": "UNKNOWN"}, "title": "Software based Power Side Channel on AMD CPUs ", "x_generator": {"engine": "Vulnogram 0.1.0-dev"}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T09:05:36.980Z"}, "title": "CVE Program Container", "references": [{"tags": ["vendor-advisory", "x_transferred"], "url": "https://www.amd.com/en/corporate/product-security/bulletin/AMD-SB-7006"}]}, {"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2024-10-17T20:12:51.921387Z", "id": "CVE-2023-20583", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-10-17T20:12:58.969Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://www.amd.com/en/corporate/product-security/bulletin/AMD-SB-7006", "tags": ["vendor-advisory", "x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T09:05:36.980Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2023-20583", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-10-17T20:12:51.921387Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-10-17T20:12:55.932Z"}}], "cna": {"title": "Software based Power Side Channel on AMD CPUs ", "source": {"advisory": "AMD-SB-7006", "discovery": "UNKNOWN"}, "affected": [{"vendor": "AMD", "product": "Processors", "versions": [{"status": "affected", "version": "Various "}], "platforms": ["x86"], "defaultStatus": "unaffected"}], "datePublic": "2023-08-01T19:30:00.000Z", "references": [{"url": "https://www.amd.com/en/corporate/product-security/bulletin/AMD-SB-7006", "tags": ["vendor-advisory"]}], "x_generator": {"engine": "Vulnogram 0.1.0-dev"}, "descriptions": [{"lang": "en", "value": "A potential power side-channel vulnerability in\nAMD processors may allow an authenticated attacker to monitor the CPU power\nconsumption as the data in a cache line changes over time potentially resulting\nin a leak of sensitive information.\n\n\n\n\n\n\n\n\n\n\n\n\n\n", "supportingMedia": [{"type": "text/html", "value": "<span style=\"background-color: rgb(248, 249, 250);\">A potential power side-channel vulnerability in\nAMD processors may allow an authenticated attacker to monitor the CPU power\nconsumption as the data in a cache line changes over time potentially resulting\nin a leak of sensitive information.\n\n\n\n</span>\n\n\n\n\n\n\n\n\n\n", "base64": false}]}], "providerMetadata": {"orgId": "b58fc414-a1e4-4f92-9d70-1add41838648", "shortName": "AMD", "dateUpdated": "2023-08-01T18:00:43.783Z"}}}, "cveMetadata": {"cveId": "CVE-2023-20583", "state": "PUBLISHED", "dateUpdated": "2024-10-17T20:12:58.969Z", "dateReserved": "2022-10-27T18:53:39.758Z", "assignerOrgId": "b58fc414-a1e4-4f92-9d70-1add41838648", "datePublished": "2023-08-01T18:00:43.783Z", "assignerShortName": "AMD"}, "dataVersion": "5.1"}

{"bugzilla": {"description": "kernel: AMD-SB-7006: potential power side-channel vulnerability in AMD processor", "id": "2228322", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2228322"}, "csaw": false, "cvss3": {"cvss3_base_score": "2.8", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:L/I:N/A:N", "status": "draft"}, "cwe": "CWE-200", "details": ["A potential power side-channel vulnerability in\nAMD processors may allow an authenticated attacker to monitor the CPU power\nconsumption as the data in a cache line changes over time potentially resulting\nin a leak of sensitive information.", "A power side-channel vulnerability was found in AMD processors. This issue may allow an authenticated attacker to monitor the CPU power consumption as the data in a cache line changes over time, resulting in a sensitive information leak."], "mitigation": {"lang": "en:us", "value": "Please contact HW vendor for more update on this CVE"}, "name": "CVE-2023-20583", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2023-08-01T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2023-20583\nhttps://nvd.nist.gov/vuln/detail/CVE-2023-20583\nhttps://www.amd.com/en/resources/product-security/bulletin/amd-sb\nhttps://www.amd.com/en/resources/product-security/bulletin/amd-sb-7006.html"], "threat_severity": "Low"}