CVE-2023-20597: amd ryzen_3_3100_firmware Access of Uninitialized Pointer

Vulnerability summary

CVE-2023-20597 is a medium (CVSS 5.5) Access of Uninitialized Pointer vulnerability in amd ryzen_3_3100_firmware. EPSS estimates a 0.18% chance of exploitation in the next 30 days, higher than 7.2% of scored vulnerabilities.

Timeline

1. 20-09-2023
   PublishedVulnerability first disclosed.
2. 27-06-2025
   Last modifiedVulnerability information updated.

Description

Improper initialization of variables in the DXE driver may allow a privileged user to leak sensitive information via local access.

• CWE-824Access of Uninitialized PointerThe product accesses or uses a pointer that has not been initialized.
• CWE-665Improper InitializationThe product does not initialize or incorrectly initializes a resource, which might leave the resource in an unexpected state when it is accessed or used.