Skip to main content

Amd Epyc 7003 Series Processors EUVDEUVD-2023-24764

| CVE-2023-20585 MEDIUM
Access of Memory Location After End of Buffer (CWE-788)
2026-04-16 AMD GHSA-c43c-pr38-m5g2
Information Disclosure Amd Amd Epyc 7003 Series Processors Amd Epyc 9004 Series Processors Amd Epyc Embedded 7003 Series Processors Amd Epyc Embedded 9004 Series Processors
5.6
CVSS 4.0 · Vendor: AMD
View

Vulnerability Assessment

Weakness
CWE
CWE-788
ASVS 5.0
V15 - Secure Coding and Architecture Pointer bounds checking
Impact

CVSS score of 5.6 (MEDIUM). Attack characteristics: local attack vector, high complexity, high privileges required, no user interaction not required. EPSS exploitation probability: 0.02%.
Exploit ScenarioDerived

Successful exploitation could compromise the medium-severity affected system.
This Month Plan within 30 days. Why: MEDIUM severity (CVSS 4.0-6.9).
Patch available 0.0% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAI

Insuffient checks of the RMP on host buffer access in IOMMU may allow an attacker with privileges and a compromised HV to trigger an out of bounds condition without RMP checks resulting in a. Rated medium severity (CVSS 5.6).

RemediationAI

A vendor patch is available. Apply the latest security update as soon as possible. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.

Affected VersionsENISA

AMD EPYC™ 7003 Series Processors patch: SEV FW 1.37.23
AMD EPYC™ 9004 Series Processors patch: SEV FW 1.37.31
AMD EPYC™ Embedded 7003 Series Processors patch: EmbMilanPI-SP3 1.0.0.B
AMD EPYC™ Embedded 9004 Series Processors patch: EmbGenoaPI-1.0.0.A

Affects your stack

Find out whether the stacks and servers you run are on an affected version.

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

This vulnerability is classified under CWE-788. Insuffient checks of the RMP on host buffer access in IOMMU may allow an attacker with privileges and a compromised HV to trigger an out of bounds condition without RMP checks resulting in a potential loss of confidential guest integrity. Affected products include: Amd Amd Epyc™ 7003 Series Processors, Amd Amd Epyc™ 9004 Series Processors, Amd Amd Epyc™ Embedded 7003 Series Processors, Amd Amd Epyc™ Embedded 9004 Series Processors.

Know when Amd Epyc 7003 Series Processors gets its next vulnerability

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (AMD) PRIMARY 5.6 MEDIUM
CVSS:4.0/AV:L/AC:H/AT:N/PR:H/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
SUSE MEDIUM
Red Hat 5.3 MEDIUM

Primary rating from Vendor (AMD).

CVSS VectorVendor: AMD

Attack Vector
Local
Attack Complexity
High
Attack Requirements
None
Privileges Required
High
User Interaction
None
Vulnerable system: Confidentiality
None
Vulnerable system: Integrity
High
Vulnerable system: Availability
None
Subsequent system: Confidentiality
None
Subsequent system: Integrity
None
Subsequent system: Availability
None

Lifecycle Timeline

3
Patch released
Apr 20, 2026 - 08:30 nvd
Patch available
CVSS changed
Apr 16, 2026 - 19:22 NVD
5.6 (MEDIUM)
CVE Published
Apr 16, 2026 - 18:42 nvd
MEDIUM 5.6

DescriptionCVE.org

Insuffient checks of the RMP on host buffer access in IOMMU may allow an attacker with privileges and a compromised HV to trigger an out of bounds condition without RMP checks resulting in a potential loss of confidential guest integrity.

Threat Intelligence Overview

EPSS Score
0.0%
Top 96% exploitable
Social Media
3
Sightings
Data Quality
7 sources
Confidence: High
EUVD NVD CVE.org EPSS Vulnrichment Vendor CIRCL VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity MEDIUM
CISA KEV No
Public POC No
EPSS 0.0%
Patch available Yes
Active threat No
Deciding rule
MEDIUM severity (CVSS 4.0-6.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived
Defer
Exploitation
None
System Exposure· derived
Small
Automatable
No
Human Impact· derived
Medium
Technical Impact
Partial

Priority Score

28
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +28
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Information Disclosure MEDIUM

Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.

More in Amd Epyc 7003 Series Processors

View all
CVE-2026-0432 HIGH
8.5 May 15

Insecure installation directory permissions in AMD chipset driver allow local authenticated attackers to achieve SYSTEM-
CVE-2025-54502 HIGH
7.1 Apr 16

Local privilege escalation in the AMD Platform Configuration Blob (APCB) SMM driver, shipped in AGESA firmware across ne
CVE-2025-61971 MEDIUM
5.9 May 13

Missing hardware lock bit protection on NBIO registers in AMD EPYC server processors (7003/8004/9004/9005 series, includ
CVE-2025-54510 MEDIUM
5.9 Apr 16

Missing lock check in the AMD Platform Security Processor (PSP) across multiple EPYC server CPU generations enables a lo
CVE-2024-21944 MEDIUM
5.3 Jun 10

Improper input validation for DIMM serial presence detect (SPD) metadata could allow an attacker with physical access, r

Same weakness CWE-788 – Access of Memory Location After End of Buffer

View all
CVE-2021-32629 HIGH POC
8.8
CVE-2022-1451 HIGH POC
7.1
CVE-2021-27384 CRITICAL
9.8
CVE-2019-8280 CRITICAL
9.8
CVE-2019-8266 CRITICAL
9.8
CVE-2019-8265 CRITICAL
9.8
CVE-2019-8264 CRITICAL
9.8
CVE-2021-21105 HIGH
8.8

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2025-68613 HIGH POC
8.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5

Vendor StatusVendor

SUSE

Severity: Medium
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise High Availability Extension 15 SP7 Fixed
SUSE Linux Enterprise High Availability Extension 15 SP7 Fixed
SUSE Linux Enterprise High Performance Computing 15 SP7 Fixed

References

Advisories & patches
ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2023-20585 ADVISORY https://ubuntu.com/security/notices/USN-8887-1 ADVISORY https://ubuntu.com/security/notices/USN-8888-1 ADVISORY https://ubuntu.com/security/notices/USN-8889-1 ADVISORY https://vuldb.com/vuln/357384 ADVISORY https://vuldb.com/vuln/357955 REF https://www.amd.com/en/resources/product-security/bulletin/AMD-SB-3016.html

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy