CVE-2023-20519

Severity: low (CVSS 3.3 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2023-11-14 · updated 2026-06-17
Weakness: CWE-416

Description

A Use-After-Free vulnerability in the management of an SNP guest context page may allow a malicious hypervisor to masquerade as the guest's migration agent resulting in a potential loss of guest integrity.

Affected products

AMD Genoapi Firmware: before 1.0.0.3 — fixed in 1.0.0.3
AMD Milanpi Firmware: before 1.0.0.a — fixed in 1.0.0.a

How to fix

Upgrade to a fixed version: AMD Genoapi Firmware 1.0.0.3; AMD Milanpi Firmware 1.0.0.a. Check the vendor advisory for mitigations.

References

https://www.amd.com/en/corporate/product-security/bulletin/AMD-SB-3002
https://www.amd.com/en/corporate/product-security/bulletin/AMD-SB-3002

Get alerted when CVE-2023-20519 or the next vulnerability affects your stack