CVE-2023-20594: amd 3rd gen amd epyc™ processors Access of Uninitialized Pointer

Vulnerability summary

CVE-2023-20594 is a medium (CVSS 4.4) Access of Uninitialized Pointer vulnerability in amd 3rd gen amd epyc™ processors. EPSS estimates a 0.19% chance of exploitation in the next 30 days, higher than 7.7% of scored vulnerabilities.

Timeline

1. 20-09-2023
   PublishedVulnerability first disclosed.
2. 27-06-2025
   Last modifiedVulnerability information updated.

Description

Improper initialization of variables in the DXE driver may allow a privileged user to leak sensitive information via local access.

• CWE-824Access of Uninitialized PointerThe product accesses or uses a pointer that has not been initialized.
• CWE-665Improper InitializationThe product does not initialize or incorrectly initializes a resource, which might leave the resource in an unexpected state when it is accessed or used.