How severe is CVE-2023-20569?

CVE-2023-20569 has a CVSS 3.x base score of 4.7, rated medium severity. It is exploitable over local access with high attack complexity, requires low privileges and no user interaction. Impact on confidentiality is high, integrity none, and availability none.

Is CVE-2023-20569 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 6% (93rd percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2023-20569?

CVE-2023-20569 primarily affects Amd Ryzen 9 5950x Firmware. In total, 160 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.

How do I fix CVE-2023-20569?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.

When was CVE-2023-20569 published?

CVE-2023-20569 was published on 2023-08-08 and last updated on 2026-06-17.

CVE-2023-20569

CVE-2023-20569 is a medium-severity vulnerability in Amd Ryzen 9 5950x Firmware with a CVSS 3.x base score of 4.7. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-203.

Key facts

Severity: Medium (CVSS 3.x base score 4.7)
EPSS exploit prediction: 6% (93rd percentile)
Actively exploited: Not listed in CISA KEV
Weakness: CWE-203
Affected product: Amd Ryzen 9 5950x Firmware
Published: 2023-08-08
Last modified: 2026-06-17

Description

A side channel vulnerability on some of the AMD CPUs may allow an attacker to influence the return address prediction. This may result in speculative execution at an attacker-controlled address, potentially leading to information disclosure.

Frequently asked questions

What is CVE-2023-20569?: A side channel vulnerability on some of the AMD CPUs may allow an attacker to influence the return address prediction. This may result in speculative execution at an attacker-controlled address, potentially leading to information disclosure.
How severe is CVE-2023-20569?: CVE-2023-20569 has a CVSS 3.x base score of 4.7, rated medium severity. It is exploitable over local access with high attack complexity, requires low privileges and no user interaction. Impact on confidentiality is high, integrity none, and availability none.
Is CVE-2023-20569 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 6% (93rd percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2023-20569?: CVE-2023-20569 primarily affects Amd Ryzen 9 5950x Firmware. In total, 160 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.
How do I fix CVE-2023-20569?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
When was CVE-2023-20569 published?: CVE-2023-20569 was published on 2023-08-08 and last updated on 2026-06-17.

References

Affected products (160)

cpe:2.3:o:fedoraproject:fedora:37:*:*:*:*:*:*:*
cpe:2.3:o:fedoraproject:fedora:38:*:*:*:*:*:*:*
cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*
cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*
cpe:2.3:o:debian:debian_linux:12.0:*:*:*:*:*:*:*
cpe:2.3:o:amd:ryzen_9_5950x_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:amd:ryzen_9_5900x_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:amd:ryzen_9_5900_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:amd:ryzen_9_pro_5945_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:amd:ryzen_7_5800x3d_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:amd:ryzen_7_5800x_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:amd:ryzen_7_5800_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:amd:ryzen_7_5700x_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:amd:ryzen_7_pro_5845_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:amd:ryzen_5_5600x3d_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:amd:ryzen_5_5600x_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:amd:ryzen_5_5600_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:amd:ryzen_5_pro_5645_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:amd:ryzen_7_5700_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:amd:ryzen_5_5500_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:amd:ryzen_3_5100_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:amd:ryzen_7_5700g_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:amd:ryzen_7_5700ge_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:amd:ryzen_5_5600g_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:amd:ryzen_5_5600ge_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:amd:ryzen_3_5300g_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:amd:ryzen_3_5300ge_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:amd:ryzen_9_7950x3d_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:amd:ryzen_9_7950x_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:amd:ryzen_9_7900x3d_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:amd:ryzen_9_7900x_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:amd:ryzen_9_7900_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:amd:ryzen_9_pro_7945_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:amd:ryzen_7_7800x3d_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:amd:ryzen_7_7700x_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:amd:ryzen_7_7700_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:amd:ryzen_7_pro_7745_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:amd:ryzen_5_7600x_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:amd:ryzen_5_7600_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:amd:ryzen_5_pro_7645_firmware:*:*:*:*:*:*:*:*

More vulnerabilities in Amd Ryzen 9 5950x Firmware

CVE-2022-23821 — Critical (CVSS 9.8): Improper access control in System Management Mode (SMM) may allow an attacker to write to SPI ROM potentially leading…
CVE-2021-26365 — High (CVSS 8.2): Certain size values in firmware binary headers could trigger out of bounds reads during signature validation, leading…
CVE-2023-20555 — High (CVSS 7.8): Insufficient input validation in CpmDisplayFeatureSmm may allow an attacker to corrupt SMM memory by overwriting an…
CVE-2021-26316 — High (CVSS 7.8): Failure to validate the communication buffer and communication service in the BIOS may allow an attacker to tamper with…
CVE-2021-26392 — High (CVSS 7.8): Insufficient verification of missing size check in 'LoadModule' may lead to an out-of-bounds write potentially allowing…
CVE-2020-12931 — High (CVSS 7.8): Improper parameters handling in the AMD Secure Processor (ASP) kernel may allow a privileged attacker to elevate their…

All CVEs affecting Amd Ryzen 9 5950x Firmware →

Other CWE-203 (Observable Discrepancy) vulnerabilities

CVE-2019-25337 — Critical (CVSS 9.8): OwnCloud 8.1.8 contains a username enumeration vulnerability that allows remote attackers to discover user accounts by…
CVE-2026-23519 — Critical (CVSS 9.8): RustCrypto CMOV provides conditional move CPU intrinsics which are guaranteed on major platforms to execute in…
CVE-2025-27667 — Critical (CVSS 9.8): Vasion Print (formerly PrinterLogic) before Virtual Appliance Host 22.0.843 Application 20.0.1923 allows Administrative…
CVE-2024-25714 — Critical (CVSS 9.8): In Rhonabwy through 1.1.13, HMAC signature verification uses a strcmp function that is vulnerable to side-channel…
CVE-2024-25191 — Critical (CVSS 9.8): php-jwt 1.0.0 uses strcmp (which is not constant time) to verify authentication, which makes it easier to bypass…
CVE-2024-25190 — Critical (CVSS 9.8): l8w8jwt 2.2.1 uses memcmp (which is not constant time) to verify authentication, which makes it easier to bypass…

Browse all CWE-203 (Observable Discrepancy) vulnerabilities →