CVE-2023-20593

MEDIUM

Xen - Error Information Exposure

Title source: rule

Description

An issue in “Zen 2” CPUs, under specific microarchitectural circumstances, may allow an attacker to potentially access sensitive information.

Exploits (1)

nomisec WORKING POC 8 stars

by sbaresearch · poc

https://github.com/sbaresearch/stop-zenbleed-win

View Code ZIP pw:eip

References (35)

[Not Applicable] http://seclists.org/fulldisclosure/2023/Jul/43

[Mailing List] http://www.openwall.com/lists/oss-security/2023/07/24/3

[Mailing List] http://www.openwall.com/lists/oss-security/2023/07/25/1

[Mailing List] http://www.openwall.com/lists/oss-security/2023/07/25/12

[Mailing List] http://www.openwall.com/lists/oss-security/2023/07/25/13

[Mailing List] http://www.openwall.com/lists/oss-security/2023/07/25/14

[Mailing List] http://www.openwall.com/lists/oss-security/2023/07/25/15

[Mailing List] http://www.openwall.com/lists/oss-security/2023/07/25/16

[Mailing List] http://www.openwall.com/lists/oss-security/2023/07/25/17

[Mailing List] http://www.openwall.com/lists/oss-security/2023/07/25/5

[Mailing List] http://www.openwall.com/lists/oss-security/2023/07/25/6

[Mailing List, Mitigation, Patch, Third Party Advisory] http://www.openwall.com/lists/oss-security/2023/07/26/1

[Mailing List, Mitigation, Patch, Third Party Advisory] http://www.openwall.com/lists/oss-security/2023/07/31/2

[Mitigation, Patch, Vendor Advisory] http://xenbits.xen.org/xsa/advisory-433.html

[Exploit] https://cmpxchg8b.com/zenbleed.html

[Mailing List] https://lists.debian.org/debian-lts-announce/2023/07/msg00030.html

[Mailing List, Third Party Advisory] https://lists.debian.org/debian-lts-announce/2023/07/msg00033.html

[Mailing List] https://lists.debian.org/debian-lts-announce/2023/08/msg00001.html

[Mailing List, Third Party Advisory] https://lists.fedoraproject.org/archives/list/[email protected]/message/CP6WQO3CDPLE5O635N7TAL5KCZ6HZ4FE/

[Vendor Advisory] https://www.amd.com/en/corporate/product-security/bulletin/AMD-SB-7008

... and 15 more

Scores

CVSS v3 5.5

EPSS 0.0632

EPSS Percentile 90.8%

Attack Vector LOCAL

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Classification

CWE

CWE-209

Status published

Affected Products (50)

xen/xen

debian/debian_linux

amd/ryzen_3_3100_firmware

amd/ryzen_3_3300x_firmware

amd/ryzen_5_3500_firmware

amd/ryzen_5_3500x_firmware

amd/ryzen_5_3600_firmware

amd/ryzen_5_3600x_firmware

amd/ryzen_5_3600xt_firmware

amd/ryzen_7_3700x_firmware

... and 35 more

Timeline

Published Jul 24, 2023

Tracked Since Feb 18, 2026