AMD Ryzenâą 3000 Series Desktop Processors âMatisseâ AM4
En bref
- Source
- NVD
- EPSS
- EPSS 5.07 % · centile 92 ()
- Ătat
- PUBLISHED
- Publiée
- Mise Ă jour
- Attribuée par
- AMD
- Statut NVD
- Modified
Description
An issue in âZen 2â CPUs, under specific microarchitectural circumstances, may allow an attacker to potentially access sensitive information.
Faiblesses (CWE)
- CWE-209 â Message d'erreur contenant des informations sensibles
Références
- https://www.amd.com/en/corporate/product-security/bulletin/AMD-SB-7008
- http://xenbits.xen.org/xsa/advisory-433.html
- http://www.openwall.com/lists/oss-security/2023/07/24/3
- http://seclists.org/fulldisclosure/2023/Jul/43
- http://www.openwall.com/lists/oss-security/2023/07/25/5
- http://www.openwall.com/lists/oss-security/2023/07/25/6
- http://www.openwall.com/lists/oss-security/2023/07/25/1
- http://www.openwall.com/lists/oss-security/2023/07/25/13
- http://www.openwall.com/lists/oss-security/2023/07/25/17
- http://www.openwall.com/lists/oss-security/2023/07/25/12
- http://www.openwall.com/lists/oss-security/2023/07/25/16
- http://www.openwall.com/lists/oss-security/2023/07/25/14
- http://www.openwall.com/lists/oss-security/2023/07/25/15
- http://www.openwall.com/lists/oss-security/2023/07/26/1
- https://cmpxchg8b.com/zenbleed.html
- https://www.debian.org/security/2023/dsa-5459
- https://lists.debian.org/debian-lts-announce/2023/07/msg00030.html
- https://www.debian.org/security/2023/dsa-5462
- https://www.debian.org/security/2023/dsa-5461
- https://lists.debian.org/debian-lts-announce/2023/07/msg00033.html
- http://www.openwall.com/lists/oss-security/2023/07/31/2
- https://lists.debian.org/debian-lts-announce/2023/08/msg00001.html
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SD2G74BXS2SWOE3FIQJ6X76S3A7PDGML/
- http://www.openwall.com/lists/oss-security/2023/08/08/7
- http://www.openwall.com/lists/oss-security/2023/08/08/8
- http://www.openwall.com/lists/oss-security/2023/08/08/6
- http://www.openwall.com/lists/oss-security/2023/08/16/4
- http://www.openwall.com/lists/oss-security/2023/08/16/5
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CP6WQO3CDPLE5O635N7TAL5KCZ6HZ4FE/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HKKYIK2EASDNUV4I7EFJKNBVO3KCKGRR/
- http://www.openwall.com/lists/oss-security/2023/09/22/9
- http://www.openwall.com/lists/oss-security/2023/09/22/11
- http://www.openwall.com/lists/oss-security/2023/09/25/4
- http://www.openwall.com/lists/oss-security/2023/09/25/7
- https://security.netapp.com/advisory/ntap-20240531-0004/
Scores
| Version | Score | Vecteur | ĂvaluĂ© par |
|---|---|---|---|
| CVSS 3.1 | MEDIUM 5.5 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N | NVD · nvd@nist.gov (Primary) |
Références européennes
- ENISA EUVD · EUVD-2023-24772
- GCVE · GCVE-0-2023-20593
Avis du CERT-FR
- CERTFR-2026-AVI-1302 â Multiples vulnĂ©rabilitĂ©s dans Xen · cert.ssi.gouv.fr
- CERTFR-2024-AVI-0575 â Multiples vulnĂ©rabilitĂ©s dans les produits Juniper Networks · cert.ssi.gouv.fr
- CERTFR-2024-AVI-0173 â Multiples vulnĂ©rabilitĂ©s dans Juniper Secure Analytics · cert.ssi.gouv.fr
- CERTFR-2024-AVI-0145 â Multiples vulnĂ©rabilitĂ©s dans les produits IBM · cert.ssi.gouv.fr
- CERTFR-2024-AVI-0119 â Multiples vulnĂ©rabilitĂ©s dans les produits Siemens · cert.ssi.gouv.fr
- CERTFR-2024-AVI-0075 â Multiples vulnĂ©rabilitĂ©s dans le noyau Linux de RedHat · cert.ssi.gouv.fr
- CERTFR-2024-AVI-0027 â Multiples vulnĂ©rabilitĂ©s dans les produits Juniper Networks · cert.ssi.gouv.fr
- CERTFR-2023-AVI-1008 â Multiples vulnĂ©rabilitĂ©s dans le noyau Linux d'Ubuntu · cert.ssi.gouv.fr
- CERTFR-2023-AVI-0989 â Multiples vulnĂ©rabilitĂ©s dans le noyau Linux de RedHat · cert.ssi.gouv.fr
- CERTFR-2023-AVI-0978 â Multiples vulnĂ©rabilitĂ©s dans le noyau Linux de RedHat · cert.ssi.gouv.fr
- CERTFR-2023-AVI-0958 â Multiples vulnĂ©rabilitĂ©s dans IBM · cert.ssi.gouv.fr
- CERTFR-2023-AVI-0950 â Multiples vulnĂ©rabilitĂ©s dans Juniper Secure Analytics · cert.ssi.gouv.fr
- CERTFR-2023-AVI-0814 â Multiples vulnĂ©rabilitĂ©s dans le noyau Linux de RedHat · cert.ssi.gouv.fr
- CERTFR-2023-AVI-0790 â Multiples vulnĂ©rabilitĂ©s dans le noyau Linux d'Ubuntu · cert.ssi.gouv.fr
- CERTFR-2023-AVI-0775 â Multiples vulnĂ©rabilitĂ©s dans le noyau Linux d'Ubuntu · cert.ssi.gouv.fr
- CERTFR-2023-AVI-0774 â Multiples vulnĂ©rabilitĂ©s dans le noyau Linux de RedHat · cert.ssi.gouv.fr
- CERTFR-2023-AVI-0753 â Multiples vulnĂ©rabilitĂ©s dans le noyau Linux de RedHat · cert.ssi.gouv.fr
- CERTFR-2023-AVI-0751 â Multiples vulnĂ©rabilitĂ©s dans le noyau Linux d'Ubuntu · cert.ssi.gouv.fr
- CERTFR-2023-AVI-0726 â Multiples vulnĂ©rabilitĂ©s dans le noyau Linux d'Ubuntu · cert.ssi.gouv.fr
- CERTFR-2023-AVI-0725 â Multiples vulnĂ©rabilitĂ©s dans le noyau Linux de RedHat · cert.ssi.gouv.fr
- CERTFR-2023-AVI-0706 â Multiples vulnĂ©rabilitĂ©s dans le noyau Linux de RedHat · cert.ssi.gouv.fr
- CERTFR-2023-AVI-0704 â Multiples vulnĂ©rabilitĂ©s dans le noyau Linux d'Ubuntu · cert.ssi.gouv.fr
- CERTFR-2023-AVI-0689 â Multiples vulnĂ©rabilitĂ©s dans le noyau Linux de SUSE · cert.ssi.gouv.fr
- CERTFR-2023-AVI-0688 â Multiples vulnĂ©rabilitĂ©s dans le noyau Linux de RedHat · cert.ssi.gouv.fr
- CERTFR-2023-AVI-0664 â Multiples vulnĂ©rabilitĂ©s dans le noyau Linux de SUSE · cert.ssi.gouv.fr
- CERTFR-2023-AVI-0653 â Multiples vulnĂ©rabilitĂ©s dans le noyau Linux de SUSE · cert.ssi.gouv.fr
- CERTFR-2023-AVI-0626 â Multiples vulnĂ©rabilitĂ©s dans le noyau Linux de SUSE · cert.ssi.gouv.fr
- CERTFR-2023-AVI-0624 â Multiples vulnĂ©rabilitĂ©s dans le noyau Linux de Debian · cert.ssi.gouv.fr
- CERTFR-2023-AVI-0622 â Multiples vulnĂ©rabilitĂ©s dans le noyau Linux de DebianLTS · cert.ssi.gouv.fr
- CERTFR-2023-AVI-0601 â Multiples vulnĂ©rabilitĂ©s dans le noyau Linux de Debian · cert.ssi.gouv.fr
- +3 autres
Configurations affectées (CPE NVD)
cpe:2.3:o:xen:xen:4.14.0:*:*:*:*:*:x86:*cpe:2.3:o:xen:xen:4.15.0:*:*:*:*:*:x86:*cpe:2.3:o:xen:xen:4.16.0:*:*:*:*:*:x86:*cpe:2.3:o:xen:xen:4.17.0:*:*:*:*:*:x86:*cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*cpe:2.3:o:debian:debian_linux:12.0:*:*:*:*:*:*:*cpe:2.3:o:amd:ryzen_3_3100_firmware:-:*:*:*:*:*:*:*cpe:2.3:o:amd:ryzen_3_3300x_firmware:-:*:*:*:*:*:*:*cpe:2.3:o:amd:ryzen_5_3500_firmware:-:*:*:*:*:*:*:*cpe:2.3:o:amd:ryzen_5_3500x_firmware:-:*:*:*:*:*:*:*cpe:2.3:o:amd:ryzen_5_3600_firmware:-:*:*:*:*:*:*:*cpe:2.3:o:amd:ryzen_5_3600x_firmware:-:*:*:*:*:*:*:*cpe:2.3:o:amd:ryzen_5_3600xt_firmware:-:*:*:*:*:*:*:*cpe:2.3:o:amd:ryzen_7_3700x_firmware:-:*:*:*:*:*:*:*cpe:2.3:o:amd:ryzen_7_3800x_firmware:-:*:*:*:*:*:*:*cpe:2.3:o:amd:ryzen_7_3800xt_firmware:-:*:*:*:*:*:*:*cpe:2.3:o:amd:ryzen_9_3900_firmware:-:*:*:*:*:*:*:*cpe:2.3:o:amd:ryzen_9_3900x_firmware:-:*:*:*:*:*:*:*cpe:2.3:o:amd:ryzen_9_3900xt_firmware:-:*:*:*:*:*:*:*cpe:2.3:o:amd:ryzen_9_3950x_firmware:-:*:*:*:*:*:*:*cpe:2.3:o:amd:ryzen_9_pro_3900_firmware:-:*:*:*:*:*:*:*cpe:2.3:o:amd:ryzen_threadripper_pro_3995wx_firmware:-:*:*:*:*:*:*:*cpe:2.3:o:amd:ryzen_threadripper_pro_3975wx_firmware:-:*:*:*:*:*:*:*cpe:2.3:o:amd:ryzen_threadripper_pro_3955wx_firmware:-:*:*:*:*:*:*:*cpe:2.3:o:amd:ryzen_threadripper_pro_3945wx_firmware:-:*:*:*:*:*:*:*cpe:2.3:o:amd:ryzen_threadripper_3990x_firmware:-:*:*:*:*:*:*:*cpe:2.3:o:amd:ryzen_threadripper_3970x_firmware:-:*:*:*:*:*:*:*cpe:2.3:o:amd:ryzen_threadripper_3960x_firmware:-:*:*:*:*:*:*:*cpe:2.3:o:amd:ryzen_7_4700g_firmware:-:*:*:*:*:*:*:*cpe:2.3:o:amd:ryzen_7_4700ge_firmware:-:*:*:*:*:*:*:*cpe:2.3:o:amd:ryzen_5_4600g_firmware:-:*:*:*:*:*:*:*cpe:2.3:o:amd:ryzen_5_4600ge_firmware:-:*:*:*:*:*:*:*cpe:2.3:o:amd:ryzen_3_4300g_firmware:-:*:*:*:*:*:*:*cpe:2.3:o:amd:ryzen_3_4300ge_firmware:-:*:*:*:*:*:*:*cpe:2.3:o:amd:ryzen_3_pro_4450u_firmware:-:*:*:*:*:*:*:*cpe:2.3:o:amd:ryzen_3_pro_4350ge_firmware:-:*:*:*:*:*:*:*cpe:2.3:o:amd:ryzen_3_pro_4350g_firmware:-:*:*:*:*:*:*:*cpe:2.3:o:amd:ryzen_3_pro_4200g_firmware:-:*:*:*:*:*:*:*cpe:2.3:o:amd:ryzen_5_pro_4650ge_firmware:-:*:*:*:*:*:*:*- +36 autres
Produits affectés
| Produit | Versions |
|---|---|
| AMD · Ryzenâą 3000 Series Desktop Processors âMatisseâ AM4 | affected various |
| AMD · AMD Ryzenâą 4000 Series Desktop Processors with Radeonâą Graphics âRenoirâ AM4 | affected various |
| AMD · 3rd Gen AMD Ryzenâą Threadripperâą Processors âCastle Peakâ HEDT | affected various |
| AMD · Ryzenâą Threadripperâą PRO Processors âCastle Peakâ WS SP3 | affected various |
| AMD · Ryzenâą 5000 Series Mobile processors with Radeonâą Graphics âLucienneâ | affected various |
| AMD · Ryzenâą 4000 Series Mobile processors with Radeonâą Graphics âRenoirâ | affected various |
| AMD · Ryzenâą 7020 Series processors âMendocinoâ FT6 | affected various |
| AMD · 2nd Gen AMD EPYC⹠Processors | affected various |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST â attribution requested |
| ENISA EUVD | ENISA â reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain â this product uses data from the NVD API but is not endorsed or certified by the NVD |