The microcode on AMD 16h 00h through 0Fh processors does not properly handle the…
Priority LOW 22CWE-399Published · Updated
Key facts
- Attack vector
- Local
- Privileges required
- None
- User interaction
- — Not recorded in CVSS 2.0
- Attack complexity
- Medium
- Impact type
- Denial of service
- Confidentiality · integrity · availability
- None · None · Complete
- Fix status
- Fixed
Attack profile from CVSS 2.0 · NVD. Fix status from CNA and Red Hat. Impact type from CWE-399 and the CVSS impact.
Summary
The microcode on AMD 16h 00h through 0Fh processors does not properly handle the interaction between locked instructions and write-combined memory types, which allows local users to cause a denial of service (system hang) via a crafted application, aka the errata 793 issue.
Why it matters now
EPSS 0.00588 48th percentileScored 2026-11-07
Fix Fixed Red Hat: 1 advisory
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
CPE configurations NVD · 3
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:amd:16h_model_processor_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | AMD |
| cpe:2.3:h:amd:16h_model_00h_processor:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | AMD |
| cpe:2.3:h:amd:16h_model_0fh_processor:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | AMD |
- cpe:2.3:o:amd:16h_model_processor_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·AMD
- cpe:2.3:h:amd:16h_model_00h_processor:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·AMD
- cpe:2.3:h:amd:16h_model_0fh_processor:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·AMD
Remediation
Red Hat 1 advisory
- RHSA-2014:0285 Released 2014-03-12 · Red Hat rating Importantkernel security, bug fix, and enhancement update
- Red Hat Enterprise Linux (v. 5 server) kernel-2.6.18-371.6.1.el5, kernel-2.6.18-371.6.1.el5.ia64, kernel-PAE-2.6.18-371.6.1.el5 +14
- Red Hat Enterprise Linux Desktop (v. 5 client) kernel-2.6.18-371.6.1.el5, kernel-PAE-2.6.18-371.6.1.el5, kernel-PAE-devel-2.6.18-371.6.1.el5 +6
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat Enterprise Linux (v. 5 server) | Fixed | RHSA-2014:0285 |
| Red Hat Enterprise Linux Desktop (v. 5 client) | Fixed | RHSA-2014:0285 |
Timeline
- 2026-10-02 Threatist record created from CVE-2013-6885
- 2026-10-03 Alias added: GHSA-pw98-hqj6-fw9c
References
Advisory 12
Other 6
- [oss-security] 20131202 Xen Security Advisory 82 (CVE-2013-6885) - Guest triggerable AMD CPU erratum may cause host to hang
- http://support.amd.com/TechDocs/51810_16h_00h-0Fh_Rev_Guide.pdf
- http://www.zdnet.com/blog/hardware/amd-owns-up-to-cpu-bug/18924
- [oss-security] 20131127 CVE-2013-6885 AMD Publ. 51810 Errata 793 system hang
- [kernel] 20111225 Buildworld loop seg-fault update -- I believe it is hardware
- https://bugzilla.redhat.com/show_bug.cgi?id=1035823
Sources
- CVE-2013-6885 · CVE Program
- CVE-2013-6885 · NVD
- FIRST EPSS
- GHSA-pw98-hqj6-fw9c · GitHub Advisory Database · CC BY 4.0
- CVE-2013-6885 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences