PT-2022-5521 · Amd+2 · Amd Processor Microcode+2

Alyssa Milburn + 7 · Published 2022-08-11 · Updated 2024-11-10 · CVE-2022-23824

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions AMD processor microcode (affected versions not specified)

Description The issue is related to the implementation of the Indirect Branch Prediction Barrier (IBPB) mechanism in AMD processor microcode, which may lead to a potential information disclosure due to incorrect clearing of the Return Address Stack (RAS). This could allow an attacker to obtain sensitive information using a side channel. The vulnerability is being actively exploited.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Information Disclosure

Weakness Enumeration

CWE-200

CWE-226

CWE-385

Related Identifiers

BDU:2022-06850

CVE-2022-23824

DSA-5378-1

OPENSUSE-SU-2023_0169-1

SUSE-SU-2023:0136-1

SUSE-SU-2023:0154-1

SUSE-SU-2023:0169-1

SUSE-SU-2023:0170-1

SUSE-SU-2023:0186-1

SUSE-SU-2023:0214-1

SUSE-SU-2023:0672-1

SUSE-SU-2023_0136-1

SUSE-SU-2023_0154-1

SUSE-SU-2023_0169-1

SUSE-SU-2023_0170-1

SUSE-SU-2023_0186-1

SUSE-SU-2023_0214-1

SUSE-SU-2023_0672-1

Affected Products

Amd Processor Microcode

Suse

Windows

References · 50

• https://nvd.nist.gov/vuln/detail/CVE-2022-23824 · Security Note
• https://osv.dev/vulnerability/ALPINE-CVE-2022-23824 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-23824 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2023:0136-1 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2023:0170-1 · Vendor Advisory
• https://amd.com/en/corporate/product-security/bulletin/amd-sb-1040 · Vendor Advisory
• https://bdu.fstec.ru/vul/2022-06850 · Security Note
• http://openwall.com/lists/oss-security/2022/11/10/2 · Patch
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YTMITQBGC23MSDHUCAPCVGLMVXIBXQTQ · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2022-23824 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-23824 · Security Note
• https://osv.dev/vulnerability/SUSE-SU-2023:0169-1 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2023:0214-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2022-23824 · Vendor Advisory
• https://debian.org/security/2023/dsa-5378 · Vendor Advisory